You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Update SQL Server Linux custom password policy documentation (#36271)
* Update SQL Server Linux custom password policy documentation
Added information on applying password policy changes without restarting SQL Server and updated limitations for minimum password length.
* Edit pass
---------
Co-authored-by: Randolph West MSFT <97149825+rwestMSFT@users.noreply.github.com>
Copy file name to clipboardExpand all lines: docs/linux/sql-server-linux-custom-password-policy.md
+34-22Lines changed: 34 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Learn how to use a custom password policy for SQL logins with SQL S
4
4
author: Madhumitatripathy
5
5
ms.author: matripathy
6
6
ms.reviewer: mikeray, randolphwest
7
-
ms.date: 05/01/2025
7
+
ms.date: 01/16/2026
8
8
ms.service: sql
9
9
ms.subservice: linux
10
10
ms.topic: how-to
@@ -30,23 +30,23 @@ Password policies are a crucial aspect of securing any database environment. The
30
30
This enforcement ensures that logins that use SQL Server authentication are secure.
31
31
32
32
> [!NOTE]
33
-
> Password policies are available on Windows. For more information, see [Password Policy](../relational-databases/security/password-policy.md).
33
+
> Password policies are available on Windows. For more information, see [Password policy](../relational-databases/security/password-policy.md).
34
34
35
35
## Custom policy settings
36
36
37
-
Beginning with [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] on Linux, you can set the following configuration parameters in the `mssql.conf` file to enforce a custom password policy.
37
+
In [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] and later versions on Linux, you can set the following configuration parameters in the `mssql.conf` file to enforce a custom password policy.
38
38
39
39
| Configuration option | Description |
40
40
| --- | --- |
41
-
|`passwordpolicy.passwordminimumlength`|Defines the minimum number of characters required for a password. The passwords can be up to 128 characters long. |
42
-
|`passwordpolicy.passwordhistorylength`|Determines the number of previous passwords that must be remembered. |
43
-
|`passwordpolicy.passwordminimumage`|Specifies the minimum duration a user must wait before changing their password again. |
41
+
|`passwordpolicy.passwordminimumlength`|Sets the minimum number of characters required for a password. Passwords can be up to 128 characters long. |
42
+
|`passwordpolicy.passwordhistorylength`|Sets the number of previous passwords that the system remembers. |
43
+
|`passwordpolicy.passwordminimumage`|Sets the minimum duration a user must wait before changing their password again. |
44
44
|`passwordpolicy.passwordmaximumage`| Sets the maximum duration a password can be used before it must be changed. |
45
45
46
46
> [!NOTE]
47
-
> Currently, the `passwordminimumlength` can be set to fewer than eight characters. [!INCLUDE [password-complexity](includes/password-complexity.md)]
47
+
> You can currently set the `passwordminimumlength` to fewer than eight characters. [!INCLUDE [password-complexity](includes/password-complexity.md)]
48
48
49
-
There are two ways to configure custom password policies for SQL authentication logins in SQL Server on Linux:
49
+
You can configure custom password policies for SQL authentication logins in SQL Server on Linux in two ways:
50
50
51
51
-[Enforce custom password policy](#adutil) with **adutil**
52
52
-[Manually configure the `mssql.conf` file](#manual) using the **mssql-conf** tool
@@ -55,19 +55,19 @@ There are two ways to configure custom password policies for SQL authentication
55
55
56
56
## Set custom password policy with adutil
57
57
58
-
In environments where policy management is centralized in an Active Directory (AD) server, domain administrators can set and modify the password policy values in the AD server. Additionally, the Linux machine running SQL Server must also be part of the Windows domain.
58
+
In environments where policy management is centralized in an Active Directory (AD) server, domain administrators set and modify the password policy values in the AD server. The Linux machine running SQL Server must also be part of the Windows domain.
59
59
60
60
Use [adutil](sql-server-linux-ad-auth-adutil-introduction.md) to fetch the password policy from the AD server and write it to the `mssql.conf` file. This method offers the benefit of centralized management, and ensures consistent application of policies across the SQL Server environment.
61
61
62
62
### Requirements for adutil
63
63
64
-
1. Establish a Kerberos authenticated session
64
+
1. Establish a Kerberos authenticated session:
65
65
66
-
- Run `kinit` with `sudo` to obtain or renew the Kerberos ticket-granting ticket (TGT).
66
+
- Run `kinit` with `sudo` to get or renew the Kerberos ticket-granting ticket (TGT).
67
67
68
-
- Use a privileged account for the `kinit` command. The account needs to have permission to connect to the domain.
68
+
- Use a privileged account for the `kinit` command. The account needs permission to connect to the domain.
69
69
70
-
In the following example, replace `<user>` with an account with elevated privileges in the domain.
70
+
In the following example, replace `<user>` with an account that has elevated privileges in the domain.
71
71
72
72
```bash
73
73
sudo kinit <user>@CONTOSO.COM
@@ -85,7 +85,7 @@ Use [adutil](sql-server-linux-ad-auth-adutil-introduction.md) to fetch the passw
85
85
sudo adutil updatepasswordpolicy
86
86
```
87
87
88
-
If the command is successful, you should see a similar message:
88
+
If the command is successful, the output looks similar to the following example:
89
89
90
90
```output
91
91
Successfully updated password policy in mssqlconf.
@@ -100,17 +100,23 @@ Use [adutil](sql-server-linux-ad-auth-adutil-introduction.md) to fetch the passw
100
100
sudo systemctl restart mssql-server
101
101
```
102
102
103
+
In [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] Cumulative Update (CU) 1 and later versions, you can apply password policy changes to SQL Server without restarting the service. Connect to the SQL Server instance and run the `sp_reload_mssqlconf` stored procedure to apply the changes:
104
+
105
+
```sql
106
+
EXECUTE sp_reload_mssqlconf;
107
+
```
108
+
103
109
<aid="manual"></a>
104
110
105
-
## Set custom password policy with mssql-conf manually
111
+
## Manually set a custom password policy using mssql-conf
106
112
107
113
You can set the SQL authentication login password policy by updating the parameters in the `mssql.conf` file with **mssql-conf**. This approach provides simplicity and direct control over the policy settings.
108
114
109
-
Use this method when the Linux host that is running SQL Server isn't part of the domain, and there's no domain controller to get the password policies from.
115
+
Use this method when the Linux host running SQL Server isn't part of the domain, and there's no domain controller to get the password policies from.
110
116
111
117
Run the following **mssql-conf** commands to set each policy configuration property.
112
118
113
-
1. Set the minimum password length to 14 characters, adhering to the complexity requirements outlined in the [Password Policy](../relational-databases/security/password-policy.md).
119
+
1. Set the minimum password length to 14 characters, adhering to the complexity requirements outlined in the [Password policy](../relational-databases/security/password-policy.md).
114
120
115
121
```bash
116
122
sudo /opt/mssql/bin/mssql-conf set passwordpolicy.passwordminimumlength 14
@@ -128,7 +134,7 @@ Run the following **mssql-conf** commands to set each policy configuration prope
128
134
sudo /opt/mssql/bin/mssql-conf set passwordpolicy.passwordhistorylength 8
129
135
```
130
136
131
-
1. Set the maximum password age is set to 45 days. A user can use a password for up to 45 days before the user must change it.
137
+
1. Set the maximum password age to 45 days. A user can use a password for up to 45 days before the user must change it.
132
138
133
139
```bash
134
140
sudo /opt/mssql/bin/mssql-conf set passwordpolicy.passwordmaximumage 45
@@ -140,19 +146,25 @@ Run the following **mssql-conf** commands to set each policy configuration prope
140
146
sudo systemctl restart mssql-server
141
147
```
142
148
149
+
In [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] CU 1, run the following stored procedure instead:
150
+
151
+
```sql
152
+
EXECUTE sp_reload_mssqlconf;
153
+
```
154
+
143
155
## Limitations
144
156
145
-
Currently, the `minimumpasswordlength` can't be set to more than 14 characters.
157
+
In [!INCLUDE [sssql22-md](../includes/sssql22-md.md)] CU 23 and [!INCLUDE [sssql25-md](../includes/sssql25-md.md)], the `minimumpasswordlength`setting can't exceed 14 characters. [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] CU 1 removes this restriction.
146
158
147
159
After updating the group password policy in Active Directory, you must manually run the `adutil updatepasswordpolicy` command to update `mssql.conf`. This command doesn't run automatically. Ensure the Linux machine running SQL Server is part of the domain, or manually set it using **mssql-conf**.
148
160
149
-
In Active Directory, each group-level password policy can be defined or undefined using a checkbox.
161
+
In Active Directory, you can define or undefine each group-level password policy using a checkbox.
However, unchecking the policy doesn't disable it in SQL Server on Linux. To avoid applying the custom password policy, update the settings in **mssql-conf** instead of relying on the checkbox.
0 commit comments