How to set a strong password policy on Linux

How to set a secure password policy on Linux

Introduction:
In the information age, protecting the sensitive information of individuals and enterprises is crucial. Passwords are one of the most commonly used authentication methods.
In Linux systems, we can increase the security of account passwords by setting strong password policies to protect the security of our computers and data.
This article will introduce how to set a secure password policy on Linux, and attach relevant code examples.

1. Modify the password policy file
   First, we need to edit the password policy file /etc/login.defs. This file contains various configuration options related to the account password.
   Open the file with a text editor and find the following line:

PASS_MAX_DAYS 99999
PASS_MIN_DAYS 0 Full sample code:

sudo vi /etc/login.defs

2. Set Password Validity Period
   In the password policy file, set the password validity period by modifying the PASS_MAX_DAYS parameter. Modify it to a smaller value, such as 90 days.
   Sample code:

# 设置密码有效期为90天 PASS_MAX_DAYS 90

3. Set the minimum password usage period
   Similarly in the password policy file, set the minimum password usage period by modifying the PASS_MIN_DAYS parameter.
   This means that the user must change the password again after a few days after changing the password. Setting a larger value can help prevent users from changing passwords frequently.
   Sample code:

# 设置密码最小使用期限为7天 PASS_MIN_DAYS 7

4. Set the minimum password length
   The length of the password is a critical security factor. In the password policy file, we can set the minimum password length by modifying the PASS_MIN_LEN parameter.
   It is recommended to set it to at least 8 characters.
   Sample code:

# 设置密码最小长度为8位 PASS_MIN_LEN 8

5. Set password strength check policy
   Allowing users to choose passwords with a certain strength is also an effective security method. In Linux, we can implement password strength checking by installing and configuring the pam_cracklib module.
   First, we need to install the module:

sudo apt-get install libpam-cracklib

Then, we need to edit the pam configuration file /etc/pam.d/common-password and add the following lines in the file:

# 密码强度检查 password requisite pam_cracklib.so retry=3 minlen=8 difok=3

The parameter retry here indicates the number of times the system requires the user to re-enter the password when the user enters a weak password.
The parameter minlen represents the minimum password length, which is recommended to be the same as the PASS_MIN_LEN set previously.
The parameter difok indicates at least how many different characters the password must contain.

6. Forcing users to use complex passwords
   In order to ensure that users create strong passwords, we can force users to use complex passwords by setting the parameters dcredit, ucredit, lcredit and ocredit of the password requisite line.
   These parameters correspond to numbers, uppercase letters, lowercase letters and special characters respectively.
   The following is a sample code:

# 密码强度检查 password requisite pam_cracklib.so retry=3 minlen=8 difok=3 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1

7. Modify the password expiration warning period
   In the password policy file, we can set the warning period before the password expires by modifying the PASS_WARN_AGE parameter. .
   Set it to an appropriate value to remind users to change their passwords in advance.
   Sample code:

# 设置密码过期前的警告期限为7天 PASS_WARN_AGE 7

8. Forced password change
   Finally, we can use the chage command to force the user to change their password the next time they log in.
   Sample code:

# 强制用户在下次登录时修改密码 sudo chage -d 0 username

Summary:
By appropriately adjusting and optimizing the password policy on the Linux system, we can increase the security of the account password.
The steps introduced above include modifying the password validity period, minimum usage period and length, setting the password strength check policy and forcing password changes, etc.
By following these steps and making appropriate adjustments based on the actual situation, we can improve the security of our passwords and effectively protect the security of our systems and data.

References:

1. https://www.tecmint.com/securing-linux-desktops-by-strengthening-passwords/
2. https:// linuxize.com/post/how-to-disable-password-expiration-in-linux/

The above is the detailed content of How to set a strong password policy on Linux. For more information, please follow other related articles on the PHP Chinese website!