PostgreSQL credcheck 6.0 adds PgBouncer integration, last-login history

HexaCluster has released version 6.0 of credcheck, a PostgreSQL extension that enforces password and authentication policies. The update allows two existing features—max_auth_failure and password_change_first_login—to work with PgBouncer, adds an optional last-login history modeled on Unix wtmp, introduces a minimum password validity window setting, and provides a pg_check_password() function for testing credentials against policy without modifying roles. The release also fixes a privilege escalation bug, memory leaks, and a heap overflow. Upgrading requires a PostgreSQL restart to reload the library.

What's new in credcheck 6.0

• PgBouncer integration: max_auth_failure and password_change_first_login now work through PgBouncer connection pooling
• credcheck.password_valid_min: forces a short VALID UNTIL window on new roles, ensuring password changes even when clients like DBeaver or pgAdmin mishandle the first-login error
• Last-login history: optional wtmp-style session logging with username, login time, duration, backend PID, source IP/port, and optional last SQL query; also records PostgreSQL boot/shutdown/crash events
• Safer password logging: no_password_logging now redacts PASSWORD '<literal>' clauses in-place with dots rather than hiding entire error statements
• pg_check_password(): new function to validate a username/password pair against policy without CREATE/ALTER ROLE operations
• Security fixes: privilege escalation via self-ALTER ROLE when password_valid_until is set, plus memory leaks and heap overflow

Why it matters

Database administrators running PostgreSQL with PgBouncer in production gain tighter security policy enforcement without losing connection-pooling benefits. The new pg_check_password() function and minimum validity window address practical deployment friction with GUI tools, while the login history feature fills a long-standing observability gap in PostgreSQL user session tracking.