CREATE/ALTER SUBSCRIPTION 语句中的连接密码在日志等处自动脱敏为 ********，防止明文密码落入日志。PostgreSQL 版本 | 支持版本 |
PostgreSQL 10 | v10.17_r1.7及以上 |
PostgreSQL 11 | v11.12_r1.6及以上 |
PostgreSQL 12 | v12.7_r1.7及以上 |
PostgreSQL 13 | v13.20_r1.23及以上 |
PostgreSQL 14 | v14.17_r1.31及以上 |
PostgreSQL 15 | v15.12_r1.17及以上 |
PostgreSQL 16 | v16.8_r1.11及以上 |
PostgreSQL 17 | v17.4_r1.5及以上 |
PostgreSQL 18 | v18.0_r1.0及以上 |
SHOW tencentdb_version; 查看当前实例的内核版本。shared_preload_libraries 参数，在其参数运行值中勾选 tencentdb_pwdcheck，保存后重启实例。tencentdb_pwdcheck.enable_tencentdb_pwdcheck，密码检查才生效；订阅密码脱敏无需该开关，插件加载后即生效。SIGHUP 级，均可在控制台参数设置中修改，保存后自动生效，无需重启实例。参数 | 默认值 | 说明 |
tencentdb_pwdcheck.enable_tencentdb_pwdcheck | off | 密码检查与认证延迟的总开关 |
tencentdb_pwdcheck.min_length | 8 | 密码最小长度 |
tencentdb_pwdcheck.max_length | 32 | 密码最大长度 |
tencentdb_pwdcheck.min_uppercase_number | 1 | 至少包含的大写字母个数 |
tencentdb_pwdcheck.min_lowercase_number | 1 | 至少包含的小写字母个数 |
tencentdb_pwdcheck.min_digit_number | 1 | 至少包含的数字个数 |
tencentdb_pwdcheck.min_special_character_number | 1 | 至少包含的特殊字符个数 |
tencentdb_pwdcheck.delay_milliseconds | 0 | 认证失败时的延迟毫秒数 |
()`~!@#$%^&*-+=_|{}[]:;'<>,.?/（不含反斜杠 \\）。密码中出现其他字符（如空格、中文）将被直接拒绝。root（tencentdb_superuser 成员），业务用户为 app_user。tencentdb_pwdcheck.enable_tencentdb_pwdcheck，将其参数运行值修改为 on 并保存。postgres=# SHOW tencentdb_pwdcheck.enable_tencentdb_pwdcheck;tencentdb_pwdcheck.enable_tencentdb_pwdcheck----------------------------------------------on(1 row)
postgres=# CREATE USER app_user PASSWORD 'weak';CREATE ROLE
postgres=# ALTER USER app_user PASSWORD '123';ALTER ROLE
root=> ALTER USER app_user PASSWORD 'asd';ERROR: Password too short. Minimum length is 8.root=> ALTER USER app_user PASSWORD 'abcdsdefg';ERROR: password need at least 1 uppercase letterroot=> ALTER USER app_user PASSWORD 'Aassdsaddb@';ERROR: password need at least 1 digitroot=> ALTER USER app_user PASSWORD 'Aassadasddb11';ERROR: password need at least 1 special characterroot=> ALTER USER app_user PASSWORD 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';ERROR: Password too long. Maximum length is 32.root=> ALTER USER app_user PASSWORD 'md5e589150ae7d28f93333afae92b36ef48';ERROR: Cannot use tencentdb_pwdcheck extension while using encrypted passwordroot=> ALTER USER app_user PASSWORD 'Aassadasddb11#$';ALTER ROLE
tencentdb_pwdcheck.min_length，将其参数运行值修改为 12 并保存。root=> ALTER USER app_user PASSWORD 'AAaa11$$';ERROR: Password too short. Minimum length is 12.root=> ALTER USER app_user PASSWORD 'AAaa11$$abcd';ALTER ROLE
CREATE SUBSCRIPTION 语句的连接串中包含发布端密码。插件加载后，该语句在数据库日志、错误详情等位置展示时，密码自动脱敏。postgres=# CREATE SUBSCRIPTION sub_testCONNECTION 'host=127.0.0.1 port=1 dbname=postgres user=replicator password=Secret@123'PUBLICATION pub_test;ERROR: subscription "sub_test" could not connect to the publisher: connection to server at "127.0.0.1", port 1 failed: Connection refusedIs the server running on that host and accepting TCP/IP connections?
pg_log 目录），记录的语句中密码已脱敏为 ********：2026-10-14 16:31:12.816 CST [4151291] LOG: statement: CREATE SUBSCRIPTION sub_testCONNECTION 'user=replicator password=******** dbname=postgres host=127.0.0.1 port=1'PUBLICATION pub_test;
ALTER SUBSCRIPTION 语句同样受脱敏保护。tencentdb_pwdcheck.delay_milliseconds 设置为大于0的值后，密码认证失败的连接将延迟响应，用于增加暴力破解成本。实测（错误密码连接，delay 设为2000ms）：延迟生效后单次失败连接耗时约2.010秒，未设置延迟（0ms）时约0.009秒。该参数仅影响认证失败的连接，正常登录无感知。shared_preload_libraries 参数已勾选 tencentdb_pwdcheck 并重启；tencentdb_pwdcheck.enable_tencentdb_pwdcheck 参数为 on；当前操作用户不是超级用户。文档反馈