Hitachi CE50-10 Instruction Manual page 83

# password policy configuration
password
dcredit=-1 ocredit=-1 reject_username enforce_for_root
In this case, the following conditions are set:
• The password must contain at least eight characters.
• The password must contain at least one uppercase alphabetic letter, one lowercase alphabetic letter, one
number, and one symbol.
• A user name cannot be contained.
• The same conditions are applied to root.
(2) Setting password generation management
This function checks whether the entered password has been used in the past. If the same password is entered, the
password change is not accepted. This setting is disabled by default.
1. To set this function, edit the configuration file.
$ sudo vi /etc/pam.d/common-password
2. In the common-password file, check the line following # password policy configuration.
# password policy configuration
password
_first_pass sha512
3. Add the remember option to the succeeding line.
The remember option checks the password for the specified number of generations, and rejects the password
change if the same password is used.
In the following example, the password change is not accepted if the same password is used within three
generations.
# password policy configuration
password
_first_pass sha512 remember=3
If the same password is entered, the following message appears.
$ passwd
Changing password for edgeadm.
(current) UNIX password:
New password:
Retype new password:
Password has been already used. Choose another.
passwd: Authentication token manipulation error
passwd: password unchanged
(3) Setting the password validity period
This function sets the validity period of a password. The validity period is not set by default, allowing a password to
be used indefinitely.
1. Run the following command to set the password validity period.
$ sudo chage -M number-of-valid-days user-name-to-set-validity-period
number-of-valid-days: Specify the number of days in the validity period. Enter 99999 to use the password
indefinitely.
When the password expires, the user of the password can no longer log in.
When the validity period is set, you must change the password within the validity period.
requisite pam_pwquality.so retry=3 minlen=8 ucredit=-1 lcredit=-1
[success=1 default=ignore]
[success=1 default=ignore]
5. Configuring Software Environment
pam_unix.so obscure use_authtok try
pam_unix.so obscure use_authtok try
67