Password Expiry and Security Policies

Detail name	Value
Changelog Number	4246
Type	New Feature
Status	Resolved
Fix Versions	Exasol 6.1.0
Resolution Date	2017-10-19

Password Policies in brief

The following new features were added to improve the security of data in Exasol.
Password Expiry Policy allows the DBA to enforce all users to update their passwords periodically. In addition, the DBA can override the Password Expiry Policy for individual users.
Password Security Policy allows the DBA to enforce all users to use complex passwords which are difficult to guess in a Brute Force attack scenario.

Setting Password Policies

By default, the features are disabled and existing users updating to the new version will not see any change in behavior with respect to Password Authentication.

The features can be enabled as follows.

Password Expiry Policy

-- System Wide Policy
-- To apply policy system-wide
ALTER SYSTEM SET PASSWORD_EXPIRY_POLICY='expiryDays=180:graceDays=15';
-- To disable Password Expiry Policy system-wide
ALTER SYSTEM SET PASSWORD_EXPIRY_POLICY='disabled';

-- Individual User Policy Override
-- To apply a different policy for individual user.
ALTER USER <user_name> PASSWORD_EXPIRY_POLICY='expiryDays=60:graceDays=7';
-- To disable policy for individual user, so password never expires.
ALTER USER <user_name> PASSWORD_EXPIRY_POLICY='disabled'; 
-- To reset policy for individual user, so system wide policy applies.
ALTER USER <user_name> PASSWORD_EXPIRY_POLICY='';

Password Security Policy

-- System Wide Policy
-- To apply policy system-wide
ALTER SYSTEM SET PASSWORD_SECURITY_POLICY='minLength=8:maxLength=16:minLowerCase=1:minUpperCase=1:minSpecialChars=1:minNumericChars=1:reusableAfterChanges=3:reusableAfterDays=365:maxLoginRetries=10';
-- To disable Password Security Policy system-wide
ALTER SYSTEM SET PASSWORD_SECURITY_POLICY='disabled';

For further details about the feature, please refer to the User Manual.