passwordcheck

1. Overview

passwordcheck is a module shipped with the IvorySQL source tree. It rejects weak passwords when the server receives a plaintext password from CREATE ROLE, CREATE USER, or ALTER ROLE. It is a lightweight baseline policy; deployments that need dictionary checks, password history, or centralized identity policy should use a dedicated authentication system.

This guide was validated with IvorySQL 5.6 (PostgreSQL 18.6) on x86_64 Linux. The bundled PostgreSQL and Oracle-compatible regression tests both passed.

2. Build and install

git clone https://github.com/IvorySQL/IvorySQL.git
cd IvorySQL
git checkout IVORY_REL_5_STABLE
cd contrib/passwordcheck
make USE_PGXS=1 PG_CONFIG=/path-to/ivorysql/bin/pg_config
sudo make USE_PGXS=1 PG_CONFIG=/path-to/ivorysql/bin/pg_config install

passwordcheck is a loadable module, not a SQL extension, so do not run CREATE EXTENSION.

3. Configuration

For consistent enforcement, append the module to shared_preload_libraries in ivorysql.conf, retaining any existing entries, and restart IvorySQL. For example:

shared_preload_libraries = 'liboracle_parser, ivorysql_ora, passwordcheck'

For a temporary test, a superuser can run LOAD 'passwordcheck'; in one session.

The minimum length defaults to 8 bytes. The following superuser command changes it for the whole instance:

SHOW passwordcheck.min_password_length;
ALTER SYSTEM SET passwordcheck.min_password_length = 12;
SELECT pg_reload_conf();

4. Validation

-- Rejected: too short.
CREATE ROLE weak_user LOGIN PASSWORD 'a1!';
-- Rejected: contains the role name.
CREATE ROLE app_user LOGIN PASSWORD 'app_user-2026!';
-- Accepted: long enough and contains letters and non-letters.
CREATE ROLE app_user LOGIN PASSWORD 'Blue-River-2026!';
ALTER ROLE app_user PASSWORD 'Green-Bridge-2027!';
DROP ROLE app_user;

Run the bundled tests from an IvorySQL build tree:

cd contrib/passwordcheck
PGPORT=5432 make installcheck
PGPORT=1521 make oracle-installcheck

5. Limitations and security notes

  • The length setting counts encoded bytes, not user-perceived characters.

  • Plaintext passwords must meet the minimum length, must not contain the role name, and must contain both letters and non-letters.

  • If the server receives a pre-encrypted password, the module cannot inspect its original complexity. Require plaintext password changes over an encrypted connection if server-side complexity enforcement is mandatory.

  • A session-level LOAD protects only that session; load the module globally when the policy must apply to every connection.

For implementation details, see the passwordcheck source directory.