How to enforce password complexity/expiration policy on CentOS 7/RHEL 7

1/Set minimum password length:

Edit minlen variable in file /etc/security/pwquality.conf:

2/Set password complexity:

Edit some variable in file /etc/security/pwquality.conf:

+ maxrepeat: Max number same character can be  repeated in new password.

+ usercheck: Whether to check if it contains the user name in new password.

+ ucredit: If set value >0 mean maximum number of uppercase characters and if set <0 mean minimum number of uppercase characters in new password.

+ dcredit: Used for setup maximum/minimum digits in new password (setup same way as ucredit variable).

+ ocredit: Used for setup maximum/minimum special characters  in new password (setup same way as ucredit variable).

3/Set password expiration:

– Use for setup maximum days user can use password, maximum number days between password changes and number off days system give user a warning about password expires.

– Edit file /etc/login.defs

– But if change PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE only effect to new account add to system. With current accounts existing before change 3 above variable need use command chage to change password expiration policy for each accounts.

# lchage -l <username>: List password expiration policy and status account of a user

# chage -M <maxday> -m <minday> -W <warning day> <account>

– If system has too many account can do this job by 2 step (using scripting) as below:

+ List all system account to file for filtering only user account for setup password expiration policy (not effect to application account and OS account)

# cat /etc/passwd | awk -F “:” ‘{print $1}’ > list_accounts.txt

+Review this file and only keep account related to user and need for setup policy

+Setup policy for these account by using this file as input of command chage

# for auser in cat list_accounts.txt; do chage -M 60 -m 3 -W 9 $auser; done

4/Set expiration specific time  for an account (Account expire):

# chage -E “mm/dd/yyyy” <account>

– Setup expiration for an account number of day from current time (create an account for partner but only working for a month)

# chage -E $(date -d +30days +%Y-%m-%d) <account>

# chage -E $(date +1months) <account>

5/Setup max login attempt for an account when using ssh connection:

– Edit file /etc/ssh/sshd_config and setup variable MaxAuthTries

6/Lock and unlock user account:

# passwd -l <account>

# passwd -u <account>


Please enter your comment!
Please enter your name here