credcheck 6 connects PgBouncer login failures to PostgreSQL ban rules
credcheck 6 adds an integration for login failures that happen inside PgBouncer, the PostgreSQL connection pooler. Those failures never reach PostgreSQL’s authentication hook, so the extension cannot count them directly. Operators must report failures from the pooler’s logs and check ban status during authentication. This lets pooled and direct connections share a threshold, but cached authentication results mean a ban may not take effect immediately.
HexaCluster · Oct 14, 2026
Why it matters
Authentication controls can miss failures when a connection pooler verifies passwords before the database sees them.
More context
The released extension exposes functions to record a failure and query ban status. Its documentation gives a fail2ban example and an auth_query integration. Try the complete path in staging. Installation requires PostgreSQL extension build tooling, shared_preload_libraries configuration and a restart; upgrading also requires a restart.
Keep in mind
Installing the extension alone does not wire up pooler failure reporting. Test log parsing, permissions and authentication-cache behavior; the documentation notes enforcement waits for a refresh or reconnect.
Original read