linux密码强度命令 linux密码解锁命令

小程序：扫一扫查出行
【扫一扫了解最新限行尾号】
复制小程序

在LINUX系统中如何设置强密码(安全性高)?

印象里

/etc/shadow

这里linux密码强度命令的密码可以从

md5sum

方式替换为

sha256sum

。这样可以提高安全度linux密码强度命令，防止

md5sum

被截取后被人碰撞出来一个可用的密码。

之后就是强密码的问题了linux密码强度命令，这个不是系统如何设置的问题，而是用户如何设置。

至少

字节，管理员权限必须

字节以上，最好是用大小写混合+数字符号。最好随机生成。

另外，还有就是其他方面的安全设置。

比如禁止远程

telnet

访问，只能用

ssh

访问，之后

ssh

绑定证书而不是用密码登录，并且禁止

root

远程登录。

剩下的就是其他各种服务的安全设置了，比如

apache

设置禁止代码访问

web

目录之外的数据，ftp

也进行权限控制，数据库限制访问来源

。

这都是细节的东西，强密码根本不是提高安全的做法，因为他是计算机系统安全所必须的要求。

linux如何设置一般用户密码必须达到一定强度？还有3月强制更改一次密码

密码复杂度在

[root@localhost ~]# vim /etc/pam.d/system-auth里

找到password requisite pam_cracklib.so在后面可以加 difok=x（要x个不同字符） minlen=x（最小密码长度） ucredit=-x（最少x个大写字母） lcredit=-x（最少x个小写字母） dcredit=-x （最少x个数字）dictpath=/usr/share/cracklib/pw_dict

时间在

[root@localhost ~]# vim /etc/login.defs

PASS_MAX_DAYS 99999 （最大什么时候过期）

PASS_MIN_DAYS 0 （最小什么事后过期）

PASS_MIN_LEN 5 （密码最小长度）

PASS_WARN_AGE 7 （警告天数）

我们在使用linux系统设置密码的时候，经常遇到这样的问题，系统提示：您的密码太简单，或者您的密码是字典的一部分。那么系统是如何实现对用户的密码的复杂度的检查的呢？

系统对密码的控制是有两部分(我知道的)组成：

1 cracklib

2 login.defs

声明：login.defs主要是控制密码的有效期。对密码进行时间管理。此处不细谈

pam_cracklib.so 才是控制密码复杂度的关键文件

redhat公司专门开发了cracklib这个安装包来判断密码的复杂度

可以rpm -ql cracklib查看

密码的复杂度的判断是通过pam模块控制来实现的，具体的模块是pam_cracklibpam_cracklib 的参数介绍：

debug

This option makes the module write information to syslog(3) indicating the behavior of the module (this option does not write password information to the log file).

type=XXX

The default action is for the module to use the following prompts when requesting passwords: "New UNIX password: " and "Retype UNIX password: ". The default word UNIX can be replaced with this option.

retry=N

Prompt user at most N times before returning with error. The default is 1

difok=N

This argument will change the default of 5 for the number of characters in the new password that must not be present in the old password. In addition, if 1/2 of the characters in the new password are different then the new password will be accepted anyway.

difignore=N

How many characters should the password have before difok will be ignored. The default is 23.

minlen=N

The minimum acceptable size for the new password (plus one if credits are not disabled which is the default). In addition to the number of characters in the new password, credit (of +1 in length) is given for each different kind of character (other, upper, lower and digit). The default for this parameter is 9 which is good for a old style UNIX password all of the same type of character but may be too low to exploit the added security of a md5 system. Note that there is a pair of length limits in Cracklib itself, a "way too short" limit of 4 which is hard coded in and a defined limit (6) that will be checked without reference to minlen. If you want to allow passwords as short as 5 characters you should not use this module.

dcredit=N

(N = 0) This is the maximum credit for having digits in the new password. If you have less than or N digits, each digit will count +1 towards meeting the current minlen value. The default for dcredit is 1 which is the recommended value for minlen less than 10.

(N 0) This is the minimum number of digits that must be met for a new password.

ucredit=N

(N = 0) This is the maximum credit for having upper case letters in the new password. If you have less than or N upper case letters each letter will count +1 towards meeting the current minlen value. The default for ucredit is 1 which is the recommended value for minlen less than 10.

(N 0) This is the minimum number of upper case letters that must be met for a new password.

lcredit=N

(N = 0) This is the maximum credit for having lower case letters in the new password. If you have less than or N lower case letters, each letter will count +1 towards meeting the current minlen value. The default for lcredit is 1 which is the recommended value for minlen less than 10.

(N 0) This is the minimum number of lower case letters that must be met for a new password.

ocredit=N

(N = 0) This is the maximum credit for having other characters in the new password. If you have less than or N other characters, each character will count +1 towards meeting the current minlen value. The default for ocredit is 1 which is the recommended value for minlen less than 10.

(N 0) This is the minimum number of other characters that must be met for a new password.

use_authtok

This argument is used to force the module to not prompt the user for a new password but use the one provided by the previously stacked password module.

dictpath=/path/to/dict

Path to the cracklib dictionaries.

dictpath=/path/to/dict //注：密码字典，这个是验证用户的密码是否是字典一部分的关键。

Path to the cracklib dictionaries.

cracklib密码强度检测过程

首先检查密码是否是字典的一部分，如果不是，则进行下面的检查

密码强度检测过程

These checks are:

Palindrome

Is the new password a palindrome of the old one?

新密码是否旧密码的回文

Case Change Only

Is the new password the the old one with only a change of case?

新密码是否只是就密码改变了大小写

Similar

Is the new password too much like the old one?

新密码是否和旧密码很相似

This is primarily controlled by one argument, difok which is a number of characters that if different between the old and new are enough to accept the new password, this defaults to 10 or 1/2 the size of the new password whichever is smaller.

To avoid the lockup associated with trying to change a long and complicated password, difignore is available. This argument can be used to specify the minimum length a new password needs to be before the difok value is ignored. The default value for difignore is 23.

Simple

Is the new password too small?

新密码是否太短

This is controlled by 5 arguments minlen, dcredit, ucredit, lcredit, and ocredit. See the section on the arguments for the details of how these work and there defaults.

Rotated

Is the new password a rotated version of the old password?

新密码的字符是否是旧密码字符的一个循环

例如旧密码：123

新密码：231

Already used

Was the password used in the past?

这个密码以前是否使用过

Previously used passwords are to be found in /etc/security/opasswd.

那么系统是如何实现这个控制的呢？

在系统的配置文件/etc/pam.d/system-auth 中有这样一行

password requisite pam_cracklib.so try_first_pass retry=3

我们可以根据pam_cracklib的参数这样配置这个pam模块来达到我们想要的目的

password required /lib/security/pam_cracklib.so retry=3 type= minlen=8 difok=3 dictpath=/path/to/dict

Linux PAM的system-auth只能对非root用户生效，那么如何对root密码做强度限制呢？

chage：密码失效是通过此命令来管理的。

参数意思：

-m 密码可更改的最小天数。为零时代表任何时候都可以更改密码。

-M 密码保持有效的最大天数。

-W 用户密码到期前，提前收到警告信息的天数。

-E 帐号到期的日期。过了这天，此帐号将不可用。

-d 上一次更改的日期

-I 停滞时期。如果一个密码已过期这些天，那么此帐号将不可用。

-l 例出当前的设置。由非特权用户来确定他们的密码或帐号何时过期。

例1

[root@localhost ~]# chage -l zhangy #查看用户密码设定情况

最近一次密码修改时间： 4月 27, 2013

密码过期时间：从不

密码失效时间：从不

帐户过期时间：从不

两次改变密码之间相距的最小天数：-1

两次改变密码之间相距的最大天数：-1

在密码过期之前警告的天数：-1

[root@localhost ~]# chage -M 90 zhangy #密码有效期90天

[root@localhost ~]# chage -d 0 zhangy #强制用户登陆时修改口令

[root@localhost ~]# chage -d 0 -m 0 -M 90 -W 15 zhangy #强制用户下次登陆时修改密码，并且设置密码最低有效期0和最高有限期90，提前15天发警报提示

例2

# chage -E '2014-09-30' test # test这个账号的有效期是2014-09-30

( 参考）

如何使用Linux命令行生成高强度密码

我们一般使用“date-s”命令来修改系统时间。比如将系统时间设定成1996年6月10日的命令如下。

#date-s06/10/96

将系统时间设定成下午1点12分0秒的命令如下。

#date-s13:12:00

注意，这里说的是系统时间，是linux由操作系统维护的。

在系统启动时，Linux操作系统将时间从CMOS中读到系统时间变量中，以后修改时间通过修改系统时间实现。为了保持系统时间与CMOS时间的一致性，Linux每隔一段时间会将系统时间写入CMOS。由于该同步是每隔一段时间（大约是11分钟）进行的，在我们执行date-s后，如果马上重起机器，修改时间就有可能没有被写入CMOS,这就是问题的原因。如果要确保修改生效可以执行如下命令。

#clock-w

这个命令强制把系统时间写入CMOS

关于linux密码强度命令和linux密码解锁命令的介绍到此就结束了，不知道你从中找到你需要的信息了吗？如果你还想了解更多这方面的信息，记得收藏关注本站。