[[email protected] ~]# cat /etc/login.defs

Please note that the parameters in this configuration file control the

behavior of the tools from the shadow-utils component. None of these

tools uses the PAM mechanism, and the utilities that use PAM (such as the

passwd command) should therefore be configured elsewhere. Refer to

/etc/pam.d/system-auth for more information.

#

REQUIRED

Directory where mailboxes reside, or name of file, relative to the

home directory. If you do define both, MAIL_DIR takes precedence.

QMAIL_DIR is for Qmail

#
#QMAIL_DIR Maildir
MAIL_DIR /var/spool/mail
#MAIL_FILE .mail

Password aging controls:

#

PASS_MAX_DAYS Maximum number of days a password may be used.

PASS_MIN_DAYS Minimum number of days allowed between password changes.

PASS_MIN_LEN Minimum acceptable password length.

PASS_WARN_AGE Number of days warning given before a password expires.

#
PASS_MAX_DAYS 99999
PASS_MIN_DAYS 0
PASS_MIN_LEN 5
PASS_WARN_AGE 7

#

Min/max values for automatic uid selection in useradd

#
UID_MIN 500
UID_MAX 60000

#

Min/max values for automatic gid selection in groupadd

#
GID_MIN 500
GID_MAX 60000

#

If defined, this command is run when removing a user.

It should remove any at/cron/print jobs etc. owned by

the user to be removed (passed as the first argument).

#
#USERDEL_CMD /usr/sbin/userdel_local

#

If useradd should create home directories for users by default

On RH systems, we do. This option is overridden with the -m flag on

useradd command line.

#
CREATE_HOME yes

The permission mask is initialized to this value. If not specified,

the permission mask will be initialized to 022.

UMASK 077

This enables userdel to remove user groups if no members exist.

#
USERGROUPS_ENAB yes

Use SHA512 to encrypt password.

ENCRYPT_METHOD SHA512

在linux，设置密码复杂度的方法有几个

1. 一个是在/etc/login.defs文件，里面几个选项
   PASS_MAX_DAYS 90 #密码最长过期天数
   PASS_MIN_DAYS 80 #密码最小过期天数
   PASS_MIN_LEN 10 #密码最小长度
   PASS_WARN_AGE 7 #密码过期警告天数
2. 另外一个方法是，修改/etc/pam.d/system-auth文件
   找到 password requisite pam_cracklib.so这么一行替换成如下：
   password requisite pam_cracklib.so retry=5 difok=3 minlen=10 ucredit=-1 lcredit=-3 dcredit=-3 dictpath=/usr/share/cracklib/pw_dict
   不需要在pw_dict后面加.pwd，因为默认会带的
   [[email protected] ~]# passwd test
   Changing password for user test.
   New password:
   /usr/share/cracklib/pw_dict.pwd.pwd: No such file or directory

参数含义：
尝试次数：5
最少不同字符：3
最小密码长度：10
最少大写字母：1
最少小写字母：3
最少数字：3
密码字典：/usr/share/cracklib/pw_dict

这样设置好，你可以做一下测试，不过需要先退出root，因为root用户并不会受这些限制，它可以设置任意的密码。

密码复杂性原则：数字，大写，小写，特殊字符
实例如下：

原文地址：http://blog.51cto.com/425319153/2092982