How to enforce strong password policies?

To enforce strong password policies in a Linux environment, you can follow these steps:

1. Install Required Packages

Ensure you have the libpam-pwquality package installed:

sudo apt update
sudo apt install -y libpam-pwquality

2. Configure PAM for Password Quality

Edit the PAM configuration file for password management:

sudo nano /etc/pam.d/common-password

Add or modify the following line to enforce password complexity:

password requisite pam_pwquality.so retry=3 minlen=8 difok=3

• minlen=8: Minimum password length of 8 characters.
• difok=3: Requires at least 3 different characters from the previous password.

3. Set Password Expiration Policies

You can set password expiration policies using the chage command. For example, to set a maximum password age of 90 days:

sudo chage -M 90 username

And to set a minimum password age of 7 days:

sudo chage -m 7 username

4. Create a Password Policy Script

You can automate the enforcement of these policies by creating a script. Here’s a simple example:

#!/bin/bash
echo "password requisite pam_pwquality.so retry=3 minlen=8 difok=3" | sudo tee -a /etc/pam.d/common-password
echo "PASS_MAX_DAYS 90" | sudo tee -a /etc/login.defs
echo "PASS_MIN_DAYS 7" | sudo tee -a /etc/login.defs
echo "PASS_WARN_AGE 7" | sudo tee -a /etc/login.defs
echo "Password policy has been updated successfully."

Make the script executable:

chmod +x ~/path/to/script.sh

5. Regularly Review and Update Policies

Regularly check and update your password policies to adapt to new security threats.

By implementing these steps, you can effectively enforce strong password policies on your Linux system. If you need more details or assistance, feel free to ask!