https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/index
    https://blog.csdn.net/wh211212/article/details/53992772
    配置密码强度
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/authconfig-pwd

    1. [root@n9e ~]# cat /etc/security/pwquality.conf |grep -v ^#
    2. minlen = 8
    3. minclass = 1
    4. maxrepeat = 0
    5. maxclassrepeat = 0
    6. lcredit     = -1
    7. ucredit     = -1
    8. dcredit     = -1
    9. ocredit     = -1
    10. [root@n9e ~]#

    最小长度为9个字符，不允许字符或类重复两次以上，并且要求同时使用大写和特殊字符

    1. [root@n9e ~]# authconfig --passminlen=9 --passminclass=3 --passmaxrepeat=2 --passmaxclassrepeat=2 --enablerequpper --enablereqother --update
    2. [root@n9e ~]# 
    3. [root@n9e ~]# cat /etc/security/pwquality.conf |grep -v ^#
    4. minlen = 9
    5. minclass = 3
    6. maxrepeat = 2
    7. maxclassrepeat = 2
    8. lcredit      = -1
    9. ucredit      = -1
    10. dcredit      = -1
    11. ocredit      = -1
    12. [root@n9e ~]#
    1. [root@n9e ~]# echo "1qaz2wsx#EDC" | pwscore
    2. Password quality check failed:
    3.  The password contains more than 2 characters of the same class consecutively
    4. [root@n9e ~]#
    1. [liwm@n9e ~]$ passwd 
    2. Changing password for user liwm.
    3. Changing password for liwm.
    4. (current) UNIX password: 
    5. New password: 
    6. BAD PASSWORD: The password is the same as the old one
    7. New password: 
    8. BAD PASSWORD: The password contains more than 2 characters of the same class consecutively
    9. New password: 
    10. BAD PASSWORD: The password contains more than 2 characters of the same class consecutively
    11. passwd: Have exhausted maximum number of retries for service
    12. [liwm@n9e ~]$
    1. [liwm@n9e ~]$ passwd 
    2. Changing password for user liwm.
    3. Changing password for liwm.
    4. (current) UNIX password: 
    5. New password: 
    6. BAD PASSWORD: The password is shorter than 9 characters
    7. New password: 
    8. BAD PASSWORD: The password fails the dictionary check - it is based on a dictionary word
    9. New password: 
    10. BAD PASSWORD: The password contains more than 2 characters of the same class consecutively
    11. passwd: Have exhausted maximum number of retries for service
    12. [liwm@n9e ~]$
    1.  # set 8 for minimum password length
    3. [root@linuxprobe~]# authconfig --passminlen=8 --update
    4. # the parameter is set in a config below
    6. [root@linuxprobe~]# grep "^minlen" /etc/security/pwquality.conf
    7. minlen = 8 
    9. # 在新密码中设置同一类的允许连续字符的最大数目
    10.  # set 4 for maximum number of allowed consecutive characters of the same class
    12. [root@linuxprobe~]# authconfig --passmaxclassrepeat=4 --update
    13. # the parameter is set in a config below
    15. [root@linuxprobe~]# grep "^maxclassrepeat" /etc/security/pwquality.conf
    16. maxclassrepeat = 4 
    18. # 在新密码中至少需要一个小写字符。
    19.  [root@linuxprobe~]# authconfig --enablereqlower --update
    20. # the parameter is set in a config below
    21. # (if you'd like to edit the value, edit it with vi and others)
    23. [root@linuxprobe~]# grep "^lcredit" /etc/security/pwquality.conf
    24. lcredit = -1 
    26. # 在新密码中至少需要一个大写字符
    27.  [root@linuxprobe~]# authconfig --enablerequpper --update
    28. # the parameter is set in a config below
    30. # (if you'd like to edit the value, edit it with vi and others)
    31. [root@linuxprobe~]# grep "^ucredit" /etc/security/pwquality.conf
    32. ucredit = -1 
    34. # 在新密码中至少需要一个数字
    35.  [root@linuxprobe~]# authconfig --enablereqdigit --update
    36. # the parameter is set in a config below
    38. # (if you'd like to edit the value, edit it with vi and others)
    39. [root@linuxprobe~]# grep "^dcredit" /etc/security/pwquality.conf
    40. dcredit = -1 
    42. # 密码包括至少一个特殊字符
    43.  [root@linuxprobe~]# authconfig --enablereqother --update
    44. # the parameter is set in a config below
    46. # (if you'd like to edit the value, edit it with vi and others)
    47. [root@linuxprobe~]# grep "^ocredit" /etc/security/pwquality.conf
    48. ocredit = -1 
    50. # 在新密码中设置单调字符序列的最大长度。 （ex⇒'12345'，'fedcb'）
    51.  [root@linuxprobe~]# vi /etc/security/pwquality.conf
    52. # add to the end
    53. maxsequence = 3 
    55. # 设置新密码中不能出现在旧密码中的字符数
    56.  [root@linuxprobe~]# vi /etc/security/pwquality.conf
    57. # add to the end
    58. difok = 5 
    60. # 检查来自用户passwd条目的GECOS字段的长度超过3个字符的字是否包含在新密码中。
    61.  [root@linuxprobe~]# vi /etc/security/pwquality.conf
    62. # add to the end
    63. gecoscheck = 1 
    65. # 设置不能包含在密码中的Ssace分隔的单词列表
    66.  [root@linuxprobe~]# vi /etc/security/pwquality.conf
    67. # add to the end
    68. badwords = denywords1 denywords2 denywords3 
    70. # 为新密码设置hash / crypt算法。 （默认为sha512）
    71. # show current algorithm
    73. [root@linuxprobe~]# authconfig --test | grep hashing
    75. password hashing algorithm is md5
    76. # chnage algorithm to sha512
    78. [root@linuxprobe~]# authconfig --passalgo=sha512 --update
    79. [root@linuxprobe~]# authconfig --test | grep hashing
    80. password hashing algorithm is sha512
    1. Options:
    2.   -h, --help              帮助
    3.   --enableshadow, --useshadow   默认启用屏蔽口令
    4.   --disableshadow         默认禁用屏蔽口令
    5.   --enablemd5, --usemd5   默认启用 MD5 口令
    6.   --disablemd5            默认禁用 MD5 口令
    7.   --passalgo=<descrypt|bigcrypt|md5|sha256|sha512>  新密码使用加密算法
    8.   --enablenis             默认使用 NIS 用户信息
    9.   --disablenis            默认禁用 NIS 用户信息
    10.   --nisdomain=<domain>    默认的 NIS 域
    11.   --nisserver=<server>    默认的 NIS 服务器
    12.   --enableldap            默认使用 LDAP 用户信息
    13.   --disableldap           默认禁用 LDAP 用户信息
    14.   --enableldapauth        默认使用 LDAP 验证
    15.   --disableldapauth       默认禁用 LDAP 验证
    16.   --ldapserver=<server>   默认的 NIS 服务器hostname或URI
    17.   --ldapbasedn=<dn>       默认的基于 DN 的 LDAP
    18.   --enableldaptls, --enableldapstarttls
    19.                         LDAP 使用 TLS
    20.   --disableldaptls, --disableldapstarttls
    21.                         LDAP 不使用 TLS
    22.   --enablerfc2307bis      enable use of RFC-2307bis schema for LDAP user information lookups
    23.   --disablerfc2307bis     disable use of RFC-2307bis schema for LDAP user information lookups
    24.   --ldaploadcacert=<URL>  从这个 URL 加载 CA 证书
    25.   --enablesmartcard       默认状态为启用智能卡验证
    26.   --disablesmartcard      默认禁用智能卡验证
    27.   --enablerequiresmartcard 默认需要使用验证智能卡验证
    28.   --disablerequiresmartcard 默认不需要使用智能卡验证
    29.   --smartcardmodule=<module> 默认使用的智能卡模块
    30.   --smartcardaction=<0=Lock|1=Ignore>
    31.                             删除智能卡时进行的操作
    32.     --enablefingerprint     默认启用指纹验证
    33.     --disablefingerprint    默认禁用指纹验证
    34.     --enableecryptfs        enable automatic per-user ecryptfs
    35.     --disableecryptfs       disable automatic per-user ecryptfs
    36.     --enablekrb5            默认启用 kerberos 验证
    37.     --disablekrb5           默认禁用 kerberos 验证
    38.     --krb5kdc=<server>      默认的 kerberos KDC
    39.   --krb5adminserver=<server>默认的 kerberos 管理服务器
    40.     --krb5realm=<realm>     默认的 kerberos 域
    41.     --enablekrb5kdcdns      启用 DNS 来查找 kerberos KDCs
    42.     --disablekrb5kdcdns     禁用 DNS 来查找 kerberos KDCs
    43.     --enablekrb5realmdns    启用 DNS 来查找 kerberos 域
    44.   --disablekrb5realmdns     禁用 DNS 来查找 kerberos 域
    45.     --enablewinbind         默认启用 winbind 来获取用户信息
    46.     --disablewinbind        默认禁用 winbind 来获取用户信息
    47.     --enablewinbindauth     默认启用 winbind 进行验证
    48.     --disablewinbindauth    默认禁用 winbind 进行验证
    49.   --smbsecurity=<user|server|domain|ads>
    50.                          samba 和 winbind 使用的安全模式
    51.     --smbrealm=<realm>      当 security=ads 时，samba 和 winbind 的默认域
    52.   --smbservers=<servers>    用来验证的服务器名称
    53.   --smbworkgroup=<workgroup>验证服务器所在的组
    54.   --smbidmaprange=<lowest-highest>, --smbidmapuid=<lowest-highest>, --smbidmapgid=<lowest-highest>
    55.                         uid range winbind will assign to domain or ads users
    56.   --winbindseparator=<\>
    57.                         the character which will be used to separate the domain and user part of winbind-created user names if winbindusedefaultdomain is not enabled
    58.   --winbindtemplatehomedir=</home/%D/%U>
    59.                         winbind 创建的用户将会作为主目录的目录
    60.   --winbindtemplateprimarygroup=<nobody>
    61.                         winbind 创建的用户将会作为主要组群的组群
    62.   --winbindtemplateshell=</bin/false>
    63.                         winbind创建的用户的shell将作为登录shell
    64.   --enablewinbindusedefaultdomain
    65.                         configures winbind to assume that users with no domain in their user names are domain users
    66.   --disablewinbindusedefaultdomain
    67.                         configures winbind to assume that users with no domain in their user names are not domain users
    68.   --enablewinbindoffline  将 winbind 配置为允许离线登录
    69.   --disablewinbindoffline 将 winbind 配置为阻止离线登录
    70.   --enablewinbindkrb5     使能winbind用Kerberos 5验证
    71.   --disablewinbindkrb5    使能winbind用默认的方法验证
    72.   --winbindjoin=<Administrator>立即作为系统管理员加入 winbind 域或 ads域
    73.   --enableipav2           enable IPAv2 for user information and authentication by default
    74.   --disableipav2          disable IPAv2 for user information and authentication by default
    75.   --ipav2domain=<domain>
    76.                         the IPAv2 domain the system should be part of
    77.   --ipav2realm=<realm>    the realm for the IPAv2 domain
    78.   --ipav2server=<servers>
    79.                         the server for the IPAv2 domain
    80.   --enableipav2nontp      do not setup the NTP against the IPAv2 domain
    81.   --disableipav2nontp     setup the NTP against the IPAv2 domain (default)
    82.   --ipav2join=<account>
    83.                         join the IPAv2 domain as this account
    84.     --enablewins            启用 wins 进行主机名解析
    85.     --disablewins           禁用 wins 进行主机名解析
    86.     --enablepreferdns       prefer dns over wins or nis for hostname resolution
    87.     --disablepreferdns      do not prefer dns over wins or nis for hostname resolution
    88.     --enablehesiod          默认启用 hesiod 来获取用户信息
    89.     --disablehesiod         默认禁用 hesiod 来获取用户信息
    90.     --hesiodlhs=<lhs>       默认的 hesiod LHS
    91.     --hesiodrhs=<rhs>       默认的 hesiod RHS
    92.     --enablesssd            enable SSSD for user information by default with manually managed configuration
    93.     --disablesssd           disable SSSD for user information by default (still used for supported configurations)
    94.     --enablesssdauth        enable SSSD for authentication by default with manually managed configuration
    95.     --disablesssdauth       disable SSSD for authentication by default (still used for supported configurations)
    96.     --enableforcelegacy     never use SSSD implicitly even for supported configurations
    97.     --disableforcelegacy    use SSSD implicitly if it supports the configuration
    98.     --enablecachecreds      enable caching of user credentials in SSSD by default
    99.     --disablecachecreds     disable caching of user credentials in SSSD by default
    100.     --enablecache           默认启用缓存用户信息，当SSSD使能时，自动失能
    101.     --disablecache          默认禁用缓存用户信息
    102.     --enablelocauthorize    本地用户可以使用本地授权
    103.    --disablelocauthorize    通过远端服务授权本地用户
    104.     --enablepamaccess       在帐户验证过程中检查 access.conf
    105.     --disablepamaccess      在帐户验证过程中不检查 access.conf
    106.     --enablesysnetauth      通过网络服务认证的系统帐号
    107.     --disablesysnetauth     仅通过本地文件认证的系统帐号
    108.     --enablemkhomedir       使能用户第一次登录创建家目录
    109.     --disablemkhomedir      失能用户第一次登录创建家目录
    110. ++++++++++++++++++++
    111. 下面的设置，其实是修改/etc/security/pwquality.conf配置文件
    112.   --passminlen=<number>     最小密码长度
    113.   --passminclass=<number>   密码中字符最小个数
    114.   --passmaxrepeat=<number>  密码中相同连续字符的最大个数
    115.   --passmaxclassrepeat=<number> 密码中同类连续字符的最大个数
    116.   --enablereqlower        使能密码中至少包含一个小写字母
    117.   --disablereqlower       失能密码中至少包含一个小写字母
    118.   --enablerequpper        使能密码中至少包含一个大写字母
    119.   --disablerequpper       失能密码中至少包含一个大写字母
    120.   --enablereqdigit        使能密码中至少包含一个数字
    121.   --disablereqdigit       失能密码中至少包含一个数字
    122.   --enablereqother        使能密码中至少包含一个特殊字符
    123.   --disablereqother       失能密码中至少包含一个特殊字符
    124. ++++++++++++++++++
    125.   --nostart               do not start/stop portmap, ypbind, and nscd
    126.   --test                  不更新配置文件，只打印配置信息
    127.   --update, --kickstart   更新配置文件
    128.   --updateall             更新所有配置文件
    129.   --probe                 probe network for defaults and print them
    130.   --savebackup=<name>     备份所有配置文件
    131.   --restorebackup=<name>  恢复配置文件的备份
    132.   --restorelastbackup     恢复备份配置文件前，预览变更配置