Applying Password Policies to All Users

[Andrew Kaplan]

Hi there --

I recently replaced an existing server with a newer model, and I was able to move the users with their respective passwords onto the new server. The new server is running the Fedora Core 7 distribution.

I want to establish a password policy that has password age at a maximum of ninety (90) days, a minimum number of days required between password changes set to zero (0) days, a warning to password expiration set at fourteen (14) days, and the number of inactivity days over the maximum days before the user's account is disabled also set to zero.

How can I set up the above configuration, and also have it immediately applied to the existing user accounts? Thanks.

[~sesh]

Under Linux password related utilities and config file(s) comes from shadow password suite.

The /etc/login.defs file can be used to define specific configuration or settings.

This normally contains:

1 . PASS_MAX_DAYS : Maximum number of days a password may be used. If the password is older than this, a password change will be forced.

2. PASS_MIN_DAYS : Minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected.

3. PASS_WARN_AGE : Number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a negative value means no warning is given. If not specified, no warning will be provided.

A typical file would be like this (for your requirement):

cat etc/login.defs
PASS_MAX_DAYS 90
PASS_MIN_DAYS 0
PASS_WARN_AGE 14

[Ivan Ferreira]

You should read this link:

http://www.puschitz.com/SecuringLinux.shtml

Ensure that the parameters are changed in the /etc/login.defs and /etc/default/useradd files.

You can use the "chage" command to apply the settings for existings users.