tencent cloud

TencentDB for PostgreSQL

문서TencentDB for PostgreSQLKernel Version IntroductionProprietary Kernel FeaturesCustom Password Complexity

Custom Password Complexity

다운로드
포커스 모드
폰트 크기
마지막 업데이트 시간: 2026-10-27 14:19:23
AI 번역
tencentdb_pwdcheck is a password security plugin developed by Tencent Cloud that provides three capabilities:
Password complexity check: When creating a user or changing a password, the system checks the password length and its composition of uppercase letters, lowercase letters, digits, and special characters. If the password does not meet the policy, an error is reported directly.
Authentication failure delay: Delays the response when password authentication fails, increasing the cost of brute-force attacks.
Subscription statement password masking: The connection password in CREATE/ALTER SUBSCRIPTION statements is automatically masked as ******** in logs and other places, preventing plaintext passwords from being written to logs.

Supported Versions

PostgreSQL Version
Supported Version
PostgreSQL 10
v10.17_r1.7 or later
PostgreSQL 11
v11.12_r1.6 or later
PostgreSQL 12
v12.7_r1.7 or later
PostgreSQL 13
v13.20_r1.23 or later
PostgreSQL 14
v14.17_r1.31 or later
PostgreSQL 15
v15.12_r1.17 or later
PostgreSQL 16
v16.8_r1.11 or later
PostgreSQL 17
v17.4_r1.5 or later
PostgreSQL 18
v18.0_r1.0 or later
Note:
You can view the kernel version of the current instance on the instance details page in the console, or by executing SHOW tencentdb_version;.

Must-Knows

Preloading the plugin: Before use, find the shared_preload_libraries parameter on the parameter settings page in the console, select tencentdb_pwdcheck in its running value, save the changes, and restart the instance.
Disabled by default: After loading the plugin, you must also enable the tencentdb_pwdcheck.enable_tencentdb_pwdcheck parameter on the parameter settings page in the console for the password check to take effect. Subscription password masking does not require this switch and takes effect immediately after the plugin is loaded.
Superusers are not subject to constraints: Superusers are not subject to password complexity check restrictions when setting passwords. Administrators (tencentdb_superuser) and regular users are subject to these constraints.
Plaintext passwords only: After the check is enabled, directly setting encrypted password strings such as md5 will be rejected.

Parameter Description

The following parameters are all at the SIGHUP level and can be modified in the console parameter settings. They take effect automatically after being saved, without requiring an instance restart.
Parameter
Default Value
Description
tencentdb_pwdcheck.enable_tencentdb_pwdcheck
off
Master switch for password check and authentication delay
tencentdb_pwdcheck.min_length
8
Minimum password length
tencentdb_pwdcheck.max_length
32
Maximum password length
tencentdb_pwdcheck.min_uppercase_number
1
Minimum number of uppercase letters
tencentdb_pwdcheck.min_lowercase_number
1
Minimum number of lowercase letters
tencentdb_pwdcheck.min_digit_number
1
Minimum number of digits
tencentdb_pwdcheck.min_special_character_number
1
Minimum number of special characters
tencentdb_pwdcheck.delay_milliseconds
0
Delay in milliseconds upon authentication failure
Valid special characters include: ()`~!@#$%^&*-+=_|{}[]:;'<>,.?/ (excluding the backslash \\). Other characters in the password, such as spaces or Chinese characters, will be rejected directly.

Usage

The following example assumes that the instance already has an administrator root (a member of tencentdb_superuser), and the business user is app_user.

1. Enabling Password Check

After the plugin is loaded, you must also enable the feature switch (a SIGHUP-level parameter that takes effect without restarting the instance). This parameter must be modified in the console:
1. Log in to the TencentDB for PostgreSQL console.
2. In the instance list, click the Instance ID or Manage in the Operation column to go to the instance details page.
3. Select Parameter Settings.
4. Search for the parameter tencentdb_pwdcheck.enable_tencentdb_pwdcheck, change its running value to on, and save the changes.
After it is enabled, you can check the parameter status by using the following statement:
postgres=# SHOW tencentdb_pwdcheck.enable_tencentdb_pwdcheck;
 tencentdb_pwdcheck.enable_tencentdb_pwdcheck
----------------------------------------------
 on
(1 row)
When it is not enabled, weak passwords can be set normally (for comparison):
postgres=# CREATE USER app_user PASSWORD 'weak';
CREATE ROLE

2. Password Complexity Validation Effect

Superusers are not restricted from setting weak passwords:
postgres=# ALTER USER app_user PASSWORD '123';
ALTER ROLE
Administrators are subject to policy constraints when setting passwords. The following examples demonstrate the errors for various non-compliant passwords and the successful acceptance of compliant passwords:
root=> ALTER USER app_user PASSWORD 'asd';
ERROR:  Password too short. Minimum length is 8.
root=> ALTER USER app_user PASSWORD 'abcdsdefg';
ERROR:  password need at least 1 uppercase letter
root=> ALTER USER app_user PASSWORD 'Aassdsaddb@';
ERROR:  password need at least 1 digit
root=> ALTER USER app_user PASSWORD 'Aassadasddb11';
ERROR:  password need at least 1 special character
root=> ALTER USER app_user PASSWORD 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
ERROR:  Password too long. Maximum length is 32.
root=> ALTER USER app_user PASSWORD 'md5e589150ae7d28f93333afae92b36ef48';
ERROR:  Cannot use tencentdb_pwdcheck extension while using encrypted password
root=> ALTER USER app_user PASSWORD 'Aassadasddb11#$';
ALTER ROLE
The default policy is: a length of 8 to 32 characters, containing at least 1 uppercase letter, 1 lowercase letter, 1 digit, and 1 special character.

3. Custom Password Policy

All policy parameters can be modified in the console parameter settings. The following example demonstrates how to adjust the minimum password length from the default value of 8 to 12:
1. Log in to the TencentDB for PostgreSQL console.
2. In the instance list, click the Instance ID or Manage in the Operation column to go to the instance details page.
3. Select Parameter Settings.
4. Search for the parameter tencentdb_pwdcheck.min_length, change its running value to 12, and save the changes.
The policy takes effect immediately after it is saved, and passwords shorter than 12 characters will be rejected:
root=> ALTER USER app_user PASSWORD 'AAaa11$$';
ERROR:  Password too short. Minimum length is 12.
root=> ALTER USER app_user PASSWORD 'AAaa11$$abcd';
ALTER ROLE

4. Password Masking for Subscription Statements

The connection string of the CREATE SUBSCRIPTION statement contains the publisher password. After the plugin is loaded, the password is automatically masked when the statement is displayed in database logs, error details, and other places.
Execute a subscription statement (the publisher address is unreachable, for demonstration only):
postgres=# CREATE SUBSCRIPTION sub_test
CONNECTION 'host=127.0.0.1 port=1 dbname=postgres user=replicator password=Secret@123'
PUBLICATION pub_test;
ERROR:  subscription "sub_test" could not connect to the publisher: connection to server at "127.0.0.1", port 1 failed: Connection refused
        Is the server running on that host and accepting TCP/IP connections?
Check the database logs (in the pg_log directory). The passwords in the recorded statements have been masked as ********:
2026-10-14 16:31:12.816 CST [4151291] LOG:  statement: CREATE SUBSCRIPTION sub_test
    CONNECTION 'user=replicator password=******** dbname=postgres host=127.0.0.1 port=1'
    PUBLICATION pub_test;
The ALTER SUBSCRIPTION statement is also protected by masking.

5. Authentication Failure Delay

After you set tencentdb_pwdcheck.delay_milliseconds to a value greater than 0 in the console parameter settings, connections with failed password authentication will be delayed to increase the cost of brute-force attacks. In a test with a wrong password and the delay set to 2000 ms, a single failed connection took about 2.010 seconds after the delay took effect, compared with about 0.009 seconds when no delay was set (0 ms). This parameter only affects connections with failed authentication, and normal logins are not affected.

FAQs

Q1: How to Troubleshoot When Password Complexity Check Is Not Triggered?

A: Confirm the following in order: shared_preload_libraries has tencentdb_pwdcheck selected and the instance has been restarted, the tencentdb_pwdcheck.enable_tencentdb_pwdcheck parameter is set to on, and the current operating user is not a superuser.

Q2: Why Does Setting an md5 Encrypted Password String Cause an Error?

A: After the check is enabled, the plugin only accepts plaintext passwords. The passwords are encrypted and stored by the database, and the plugin cannot verify pre-encrypted password strings.

Q3: Can a Backslash Be Used in a Password?

A: No. The backslash is not within the valid special character range, and passwords containing a backslash will be rejected.

Q4: Does Authentication Failure Delay Affect Normal Login?

A: No. The delay is triggered only when password authentication fails, and successfully authenticated connections do not incur any delay.

Related References

이전 주제: Multi-Tenancy Capabilities다음 주제: SQL Firewall

도움말 및 지원

문제 해결에 도움이 되었나요?

피드백

키워드로 검색
    Enter keywords to search documentation