centos7如何设置密码规则?centos7设置密码规则的方法
<p><span style="color: #ff0000"><strong>出于安全考虑设置密码规则</strong></span></p><div class="jb51code">
<pre class="brush:plain;">
设置密码到期的天数。
用户必须在天内更改密码。
此设置仅影响创建用户，而不会影响现有用户。
如果设置为现有用户，请运行命令“chage -M（days）（user）”。</pre>
</div>
<div class="jb51code">
<pre class="brush:plain;">
PASS_MAX_DAYS 60 # 密码到期时间
PASS_MIN_DAYS 3 # 初始密码更改时间
PASS_MIN_LEN 8 # 密码最小长度
PASS_WARN_AGE 7 # 密码过期提示时间</pre>
</div>
<p>重复密码限制使用</p>
<div class="jb51code">
<pre class="brush:plain;">
# vi /etc/pam.d/system-auth
# near line 15: prohibit to use the same password for 5 generation in past
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5</pre>
</div>
<p>设置最小密码长度。 用户不能设置小于此参数的密码长度。</p>
<div class="jb51code">
<pre class="brush:plain;">
# set 8 for minimum password length
# authconfig --passminlen=8 --update
# the parameter is set in a config below
# grep "^minlen" /etc/security/pwquality.conf
minlen = 8
# 在新密码中设置同一类的允许连续字符的最大数目
# set 4 for maximum number of allowed consecutive characters of the same class
# authconfig --passmaxclassrepeat=4 --update
# the parameter is set in a config below
# grep "^maxclassrepeat" /etc/security/pwquality.conf
maxclassrepeat = 4
# 在新密码中至少需要一个小写字符。
# authconfig --enablereqlower --update
# the parameter is set in a config below
# (if you'd like to edit the value, edit it with vi and others)
# grep "^lcredit" /etc/security/pwquality.conf
lcredit = -1
# 在新密码中至少需要一个大写字符
# authconfig --enablerequpper --update
# the parameter is set in a config below
# (if you'd like to edit the value, edit it with vi and others)
# grep "^ucredit" /etc/security/pwquality.conf
ucredit = -1
# 在新密码中至少需要一个数字
# authconfig --enablereqdigit --update
# the parameter is set in a config below
# (if you'd like to edit the value, edit it with vi and others)
# grep "^dcredit" /etc/security/pwquality.conf
dcredit = -1
# 密码包括至少一个特殊字符
# authconfig --enablereqother --update
# the parameter is set in a config below
# (if you'd like to edit the value, edit it with vi and others)
# grep "^ocredit" /etc/security/pwquality.conf
ocredit = -1
# 在新密码中设置单调字符序列的最大长度。 （ex⇒'12345'，'fedcb'）
# vi /etc/security/pwquality.conf
# add to the end
maxsequence = 3
# 设置新密码中不能出现在旧密码中的字符数
# vi /etc/security/pwquality.conf
# add to the end
difok = 5
# 检查来自用户passwd条目的GECOS字段的长度超过3个字符的字是否包含在新密码中。
# vi /etc/security/pwquality.conf
# add to the end
gecoscheck = 1
# 设置不能包含在密码中的Ssace分隔的单词列表
# vi /etc/security/pwquality.conf
# add to the end
badwords = denywords1 denywords2 denywords3
# 为新密码设置hash / crypt算法。 （默认为sha512）
# show current algorithm
# authconfig --test | grep hashing
password hashing algorithm is md5
# chnage algorithm to sha512
# authconfig --passalgo=sha512 --update
# authconfig --test | grep hashing
password hashing algorithm is sha512 </pre>
</div>
頁:
[1]