centos设置密码复杂度

系统版本：CentOS release 6.9 (Final)
1.设置密码复杂度
vim /etc/pam.d/system-auth

password    requisite     /lib/security/$ISA/pam_passwdqc.so  min=disabled,24,16,8,10  passphrase=3 max=40 enforce=everyone retry=3 similar=deny  

样本：

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so
#password    requisite     pam_cracklib.so try_first_pass retry=3 type=
#password  requisite pam_cracklib.so retry=5  difok=3 minlen=10 ucredit=-1 lcredit=-3 dcredit=-3 dictpath=/usr/share/cracklib/pw_dict
password    requisite     /lib/security/$ISA/pam_passwdqc.so  min=disabled,24,16,8,10  passphrase=3 max=40 enforce=everyone retry=3 similar=deny
password    requisite     pam_cracklib.so retry=3 difok=3 minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

2.设置密码过期时间
vim /etc/login.defs

PASS_MAX_DAYS   2
PASS_MIN_DAYS   1
PASS_MIN_LEN    8
PASS_WARN_AGE   1

参考地址：https://www.cnblogs.com/dadonggg/p/7975710.html
3.登录N次禁止

vim /etc/pam.d/login
首行添加

auth      required  pam_tally2.so   deny=3  lock_time=300 even_deny_root root_unlock_time=10

样本：

#%PAM-1.0
auth       required     pam_tally2.so   deny=3  lock_time=300 even_deny_root root_unlock_time=10
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    optional     pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      system-auth
-session   optional     pam_ck_connector.so

vim /etc/pam.d/sshd

首行添加

auth      required  pam_tally2.so   deny=3  lock_time=300 even_deny_root root_unlock_time=10

样本：

#%PAM-1.0
auth      required  pam_tally2.so   deny=3  lock_time=300 even_deny_root root_unlock_time=10
auth       required     pam_sepermit.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth

查看登录失败的次数：pam_tally2 --user root
解封：pam_tally2 -r -u root
参考地址：https://www.cnblogs.com/wudonghang/p/f4655ae78d0fe207a5f5ccce9d8ef684.html
如果锁定密码登录不生效请使用以下方法：
vim /etc/pam.d/system-auth

auth required pam_tally2.so onerr=fail deny=3 unlock_time=30 even_deny_root root_unlock_time=100