security,sql: add a setting to constrain the minimum password length#51502
Merged
craig[bot] merged 2 commits intocockroachdb:masterfrom Jul 17, 2020
Merged
security,sql: add a setting to constrain the minimum password length#51502craig[bot] merged 2 commits intocockroachdb:masterfrom
craig[bot] merged 2 commits intocockroachdb:masterfrom
Conversation
Member
|
This change is |
7396763 to
7a3d858
Compare
RichardJCai
approved these changes
Jul 16, 2020
Contributor
RichardJCai
left a comment
There was a problem hiding this comment.
Reviewable status:
complete! 0 of 0 LGTMs obtained (waiting on @knz and @RichardJCai)
pkg/security/password.go, line 84 at r2 (raw file):
// MinPasswordLength is the cluster setting that configures the // minimum SQL password length. var MinPasswordLength = settings.RegisterIntSetting(
I think RegisterNonNegativeIntSetting makes a little more sense here even though it doesn't actually change the behaviour. LGTM otherwise
This also removes some obsolete code, and ensures that the username validity check is performed before the password validity check. Release note: None
7a3d858 to
d5f1e63
Compare
knz
commented
Jul 17, 2020
Contributor
Author
knz
left a comment
There was a problem hiding this comment.
Reviewable status:
pkg/security/password.go, line 84 at r2 (raw file):
Previously, RichardJCai (Richard Cai) wrote…
I think RegisterNonNegativeIntSetting makes a little more sense here even though it doesn't actually change the behaviour. LGTM otherwise
Done.
Contributor
Author
|
bors r=RichardJCai |
Contributor
Author
|
cc @joshimhoff for eventual deployment in CC |
Contributor
Author
|
bors r- |
Contributor
Canceled |
Contributor
Author
|
bors r=RichardJCai |
Contributor
Author
|
bors r- |
Contributor
Canceled |
Requested by @bdarnell. This change adds a new cluster setting `server.user_login.min_password_length`. When set and non-zero, it forces a minimum password length to passwords passed in cleartext to the SQL `WITH PASSWORD` clause (`CREATE/ALTER USER/ROLE`). This change is part of a larger set of security measures to help the secure deployment of Cockroach Cloud. We are not yet planning to advertise this to on-prem users until the feature matures and is complemented by additional enhancements to password authentication. Release note: None
d5f1e63 to
8b0a637
Compare
Contributor
Author
|
bors r=RichardJCai |
Contributor
Canceled (will resume) |
Contributor
Build succeeded |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by @bdarnell.
First commit from #51501.
This change adds a new cluster setting
server.user_login.min_password_length. When set and non-zero, itforces a minimum password length to passwords passed in cleartext to
the SQL
WITH PASSWORDclause (CREATE/ALTER USER/ROLE).This change is part of a larger set of security measures to help
the secure deployment of Cockroach Cloud. We are not yet planning
to advertise this to on-prem users until the feature matures and
is complemented by additional enhancements to password authentication.
cc @solongordon @thtruo @aaron-crl for visibility.