{"id":3146,"date":"2026-02-06T14:23:12","date_gmt":"2026-02-06T06:23:12","guid":{"rendered":"https:\/\/linuxjk.cn\/?p=3146"},"modified":"2026-02-06T14:23:16","modified_gmt":"2026-02-06T06:23:16","slug":"linux%e6%9c%8d%e5%8a%a1%e5%99%a8%e9%85%8d%e7%bd%ae%e5%af%86%e7%a0%81%e5%a4%8d%e6%9d%82%e5%ba%a6%e5%92%8c%e6%9c%89%e6%95%88%e6%9c%9f","status":"publish","type":"post","link":"https:\/\/linuxjk.cn\/?p=3146","title":{"rendered":"linux\u670d\u52a1\u5668\u914d\u7f6e\u5bc6\u7801\u590d\u6742\u5ea6\u548c\u6709\u6548\u671f"},"content":{"rendered":"\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_88 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">\u76ee\u5f55<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/linuxjk.cn\/?p=3146\/#%E8%A1%A8%E6%A0%BC17%E6%9D%A1\" >\u8868\u683c17\u6761<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/linuxjk.cn\/?p=3146\/#%E6%89%8B%E5%8A%A8%E9%85%8D%E7%BD%AE%E6%AD%A5%E9%AA%A4%EF%BC%9A\" >\u624b\u52a8\u914d\u7f6e\u6b65\u9aa4\uff1a<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/linuxjk.cn\/?p=3146\/#%E8%87%AA%E5%8A%A8%E5%8C%96%E8%84%9A%E6%9C%AC\" >\u81ea\u52a8\u5316\u811a\u672c<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/linuxjk.cn\/?p=3146\/#%E9%85%8D%E7%BD%AE%E5%90%8E%E9%AA%8C%E8%AF%81%E6%B8%85%E5%8D%95\" >\u914d\u7f6e\u540e\u9a8c\u8bc1\u6e05\u5355<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E8%A1%A8%E6%A0%BC17%E6%9D%A1\"><\/span>\u8868\u683c17\u6761<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u670d\u52a1\u5668\u672a\u914d\u7f6e\u5bc6\u7801\u590d\u6742\u5ea6\u548c\u5bc6\u7801\u6709\u6548\u671f\uff0c\u53ef\u80fd\u4f1a\u88ab\u8bbe\u7f6e\u4e3a\u5f31\u53e3\u4ee4\u548c\u957f\u65f6\u95f4\u4f7f\u7528\uff0c\u6076\u610f\u4eba\u5458\u53ef\u80fd\u901a\u8fc7\u731c\u89e3\u6216\u66b4\u529b\u7834\u89e3\u53e3\u4ee4\u975e\u6cd5\u767b\u5f55\u3002<\/th><th>Web\u670d\u52a1\u5668 \uff08172.22.3.2\uff09 \u6570\u636e\u5e93\u670d\u52a1\u56681 \uff08172.22.3.129\uff09 \u6570\u636e\u5e93\u670d\u52a1\u56682 \uff08172.22.3.130\uff09 \u5e94\u7528\u670d\u52a1\u5668 \uff08172.22.3.131\uff09 Web\u670d\u52a1\u5668 \uff08172.22.3.3\uff09 \u6570\u636e\u5e93\u670d\u52a1\u5668 \uff08172.22.3.133\uff09 \u5e94\u7528\u670d\u52a1\u56681 \uff08172.22.3.134\uff09 \u5e94\u7528\u670d\u52a1\u56682 \uff08172.22.3.135\uff09<\/th><th>\u9ad8<\/th><th>\u5efa\u8baeLinux\u670d\u52a1\u5668\u5728\/etc\/pam.d\/system-auth\u914d\u7f6e\u6587\u4ef6\u4e2d\u914d\u7f6e\u5bc6\u7801\u6700\u5c0f\u957f\u5ea6\u4e3a8\u4f4d\uff0c\u5f15\u7528pwquality.so\u6a21\u5757\uff0c\u914d\u7f6e\u5bc6\u7801\u5fc5\u987b\u7531\u5927\u5c0f\u5199\u5b57\u6bcd\u3001\u6570\u5b57\u3001\u7279\u6b8a\u5b57\u7b26\u4e2d\u4e09\u79cd\u6216\u4e09\u79cd\u4ee5\u4e0a, \u5bc6\u7801\u6709\u6548\u671f\u4e3a90\u5929\u3002<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E6%89%8B%E5%8A%A8%E9%85%8D%E7%BD%AE%E6%AD%A5%E9%AA%A4%EF%BC%9A\"><\/span>\u624b\u52a8\u914d\u7f6e\u6b65\u9aa4\uff1a<span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<pre class=\"wp-block-preformatted\">\u4e00\u3001\u5b89\u88c5\u5fc5\u8981\u7684\u8f6f\u4ef6\u5305<br># \u68c0\u67e5\u662f\u5426\u5df2\u5b89\u88c5 pwquality<br>rpm -qa | grep libpwquality<br># \u5982\u679c\u672a\u5b89\u88c5\uff0c\u6267\u884c\u5b89\u88c5<br>yum install -y libpwquality<br>\u200b<br>\u4e8c\u3001\u914d\u7f6e\u5bc6\u7801\u590d\u6742\u5ea6\u8981\u6c42<br>1. \u7f16\u8f91 `\/etc\/pam.d\/system-auth`<br># \u5907\u4efd\u539f\u6587\u4ef6<br>cp \/etc\/pam.d\/system-auth \/etc\/pam.d\/system-auth.bak.$(date +%F)<br># \u7f16\u8f91\u6587\u4ef6<br>vim \/etc\/pam.d\/system-auth<br>\u200b<br>2. \u4fee\u6539 `password requisite` \u884c<br>\u627e\u5230\u7c7b\u4f3c\u8fd9\u6837\u7684\u884c\uff1a<br>password &nbsp;  requisite &nbsp; &nbsp; pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=<br>\u200b<br>**\u66ff\u6362\u4e3a\uff1a**<br>password &nbsp;  requisite &nbsp; &nbsp; pam_pwquality.so try_first_pass retry=3 authtok_type= minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 minclass=3 enforce_for_root<br>\u200b<br>\u540c\u6b65\u4fee\u6539 `\/etc\/pam.d\/password-auth`<br># \u5907\u4efd<br>cp \/etc\/pam.d\/password-auth \/etc\/pam.d\/password-auth.bak.$(date +%F)<br># \u76f4\u63a5\u590d\u5236 system-auth \u7684\u914d\u7f6e<br>cp \/etc\/pam.d\/system-auth \/etc\/pam.d\/password-auth<br>\u200b<br>\u4e09\u3001\u914d\u7f6e pwquality \u8be6\u7ec6\u53c2\u6570<br># \u7f16\u8f91 `\/etc\/security\/pwquality.conf`<br># \u5907\u4efd<br>cp \/etc\/security\/pwquality.conf \/etc\/security\/pwquality.conf.bak.$(date +%F)<br># \u7f16\u8f91\u6587\u4ef6<br>vim \/etc\/security\/pwquality.conf<br>\u200b<br>### \u6dfb\u52a0\u6216\u4fee\u6539\u4ee5\u4e0b\u5185\u5bb9\uff1a<br>\u200b<br># \u5bc6\u7801\u6700\u5c0f\u957f\u5ea6 8 \u4f4d<br>minlen = 8<br># \u81f3\u5c11\u5305\u542b 1 \u4e2a\u5c0f\u5199\u5b57\u6bcd\uff08-1 \u8868\u793a\u81f3\u5c11 1 \u4e2a\uff09<br>#lcredit = -1<br># \u81f3\u5c11\u5305\u542b 1 \u4e2a\u5927\u5199\u5b57\u6bcd<br>#ucredit = -1<br># \u81f3\u5c11\u5305\u542b 1 \u4e2a\u6570\u5b57<br>#dcredit = -1<br># \u81f3\u5c11\u5305\u542b 1 \u4e2a\u7279\u6b8a\u5b57\u7b26<br>#ocredit = -1<br># \u2705 \u4e0d\u5f3a\u5236\u8981\u6c42\u6bcf\u79cd\u5b57\u7b26\u7c7b\u578b\uff0c\u53ea\u8981\u6c42\u81f3\u5c11 3 \u79cd\u5373\u53ef<br># \u81f3\u5c11\u5305\u542b 3 \u79cd\u5b57\u7b26\u7c7b\u578b\uff08\u5c0f\u5199\u3001\u5927\u5199\u3001\u6570\u5b57\u3001\u7279\u6b8a\u5b57\u7b26\uff09<br>minclass = 3<br># \u65b0\u5bc6\u7801\u4e2d\u6700\u591a\u6709 3 \u4e2a\u5b57\u7b26\u4e0e\u65e7\u5bc6\u7801\u76f8\u540c<br>difok = 3<br># \u7981\u6b62\u4f7f\u7528\u7528\u6237\u540d<br>usercheck = 1<br># \u7981\u6b62\u4f7f\u7528\u5b57\u5178\u5355\u8bcd<br>dictcheck = 1<br>\u200b<br>\u200b<br>\u56db\u3001\u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f 90 \u5929<br>### \u65b9\u6cd5 1\uff1a\u4fee\u6539 `\/etc\/login.defs`\uff08\u5168\u5c40\u9ed8\u8ba4\uff09<br># \u5907\u4efd<br>cp \/etc\/login.defs \/etc\/login.defs.bak.$(date +%F)<br>\u200b<br># \u7f16\u8f91\u6587\u4ef6<br>vim \/etc\/login.defs<br>### \u4fee\u6539\u4ee5\u4e0b\u53c2\u6570\uff1a<br># \u5bc6\u7801\u6700\u5927\u6709\u6548\u671f\uff0890 \u5929\uff09<br>PASS_MAX_DAYS &nbsp; 90<br># \u5bc6\u7801\u6700\u5c0f\u4fee\u6539\u95f4\u9694\uff080 \u8868\u793a\u968f\u65f6\u53ef\u6539\uff09<br>PASS_MIN_DAYS &nbsp; 0<br># \u5bc6\u7801\u8fc7\u671f\u524d\u63d0\u524d\u8b66\u544a\u5929\u6570\uff087 \u5929\uff09<br>PASS_WARN_AGE &nbsp; 7<br># \u5bc6\u7801\u6700\u5c0f\u957f\u5ea6\uff08\u8fd9\u91cc\u8bbe\u7f6e 8\uff0c\u4f46\u4e3b\u8981\u7531 pwquality \u63a7\u5236\uff09<br>PASS_MIN_LEN &nbsp; &nbsp;8<br>\u200b<br>### \u65b9\u6cd5 2\uff1a\u5bf9\u5df2\u5b58\u5728\u7684\u7528\u6237\u4fee\u6539\u5bc6\u7801\u7b56\u7565<br># \u67e5\u770b\u5f53\u524d\u7528\u6237\u5bc6\u7801\u7b56\u7565<br>chage -l root<br># \u4e3a\u73b0\u6709\u7528\u6237\u8bbe\u7f6e\u5bc6\u7801\u6709\u6548\u671f 90 \u5929<br>chage -M 90 root<br>\u200b<br># \u6279\u91cf\u4fee\u6539\u6240\u6709\u666e\u901a\u7528\u6237\uff08UID &gt;= 1000\uff09<br>for user in $(awk -F: '$3&gt;=1000 &amp;&amp; $3!=65534 {print $1}' \/etc\/passwd); do<br> &nbsp;  chage -M 90 -m 1 -W 7 \"$user\"<br> &nbsp; &nbsp;echo \"\u5df2\u8bbe\u7f6e\u7528\u6237 $user \u7684\u5bc6\u7801\u7b56\u7565\"<br>done<br>\u200b<br>\u200b<br>\u4e94\u3001\u53c2\u6570\u8bf4\u660e<br>PAM \u6a21\u5757\u53c2\u6570\uff1a<br>| \u53c2\u6570 | \u8bf4\u660e | \u793a\u4f8b |<br>|------|------|------|<br>| `minlen=8` | \u5bc6\u7801\u6700\u5c0f\u957f\u5ea6 8 \u4f4d | `minlen=8` |<br>| `dcredit=-1` | \u81f3\u5c11\u5305\u542b 1 \u4e2a\u6570\u5b57 | `-1` \u8868\u793a\u81f3\u5c11 1 \u4e2a |<br>| `ucredit=-1` | \u81f3\u5c11\u5305\u542b 1 \u4e2a\u5927\u5199\u5b57\u6bcd | `-1` \u8868\u793a\u81f3\u5c11 1 \u4e2a |<br>| `lcredit=-1` | \u81f3\u5c11\u5305\u542b 1 \u4e2a\u5c0f\u5199\u5b57\u6bcd | `-1` \u8868\u793a\u81f3\u5c11 1 \u4e2a |<br>| `ocredit=-1` | \u81f3\u5c11\u5305\u542b 1 \u4e2a\u7279\u6b8a\u5b57\u7b26 | `-1` \u8868\u793a\u81f3\u5c11 1 \u4e2a |<br>| `minclass=3` | \u81f3\u5c11\u5305\u542b 3 \u79cd\u5b57\u7b26\u7c7b\u578b | \u5c0f\u5199\u3001\u5927\u5199\u3001\u6570\u5b57\u3001\u7279\u6b8a\u5b57\u7b26\u4e2d\u81f3\u5c11 3 \u79cd |<br>| `retry=3` | \u5bc6\u7801\u8bbe\u7f6e\u5931\u8d25\u540e\u91cd\u8bd5\u6b21\u6570 | \u6700\u591a\u91cd\u8bd5 3 \u6b21 |<br>| `remember=5` | \u8bb0\u4f4f\u6700\u8fd1 5 \u6b21\u5bc6\u7801\uff0c\u9632\u6b62\u91cd\u590d\u4f7f\u7528 | \u5728 `pam_unix.so` \u884c\u914d\u7f6e |<br>### login.defs \u53c2\u6570\uff1a<br>| \u53c2\u6570 | \u8bf4\u660e | \u63a8\u8350\u503c |<br>|------|------|--------|<br>| `PASS_MAX_DAYS` | \u5bc6\u7801\u6700\u5927\u6709\u6548\u671f\uff08\u5929\uff09 | `90` |<br>| `PASS_MIN_DAYS` | \u4e24\u6b21\u4fee\u6539\u5bc6\u7801\u7684\u6700\u5c0f\u95f4\u9694\uff08\u5929\uff09 | `1` |<br>| `PASS_WARN_AGE` | \u5bc6\u7801\u8fc7\u671f\u524d\u8b66\u544a\u5929\u6570 | `7` |<br>| `PASS_MIN_LEN` | \u5bc6\u7801\u6700\u5c0f\u957f\u5ea6\uff08\u88ab pwquality \u8986\u76d6\uff09 | `8` |<br>## \u516d\u3001\u9a8c\u8bc1\u914d\u7f6e<br>### 1. \u6d4b\u8bd5\u5bc6\u7801\u590d\u6742\u5ea6<br># \u521b\u5efa\u6d4b\u8bd5\u7528\u6237<br>useradd testuser<br># \u5c1d\u8bd5\u8bbe\u7f6e\u4e0d\u7b26\u5408\u89c4\u5219\u7684\u5bc6\u7801<br>passwd testuser<br>\u200b<br>\u200b<br>**\u6d4b\u8bd5\u6848\u4f8b\uff1a**<br>| \u5bc6\u7801 | \u662f\u5426\u901a\u8fc7 | \u539f\u56e0 |<br>|------|---------|------|<br>| `123456` | \u274c | \u957f\u5ea6\u4e0d\u8db3 8 \u4f4d |<br>| `12345678` | \u274c | \u53ea\u6709\u6570\u5b57\uff0c\u672a\u6ee1\u8db3 3 \u79cd\u5b57\u7b26\u7c7b\u578b |<br>| `Abcd1234` | \u274c | \u6ca1\u6709\u7279\u6b8a\u5b57\u7b26\uff0c\u53ea\u6709 3 \u79cd\u5b57\u7b26\u7c7b\u578b\uff08\u9700\u8981\u7279\u6b8a\u5b57\u7b26\uff09 |<br>| `Abcd@123` | \u2705 | \u5305\u542b\u5927\u5199\u3001\u5c0f\u5199\u3001\u6570\u5b57\u3001\u7279\u6b8a\u5b57\u7b26\uff0c\u6ee1\u8db3 minclass=3 |<br>| `Test@123` | \u2705 | \u7b26\u5408\u6240\u6709\u8981\u6c42 |<br>| `testuser` | \u274c | \u5305\u542b\u7528\u6237\u540d |<br>### 2. \u68c0\u67e5\u5bc6\u7801\u6709\u6548\u671f<br>\u200b<br># \u67e5\u770b\u7528\u6237\u5bc6\u7801\u7b56\u7565<br>chage -l testuser<br>\u200b<br># \u9884\u671f\u8f93\u51fa\uff1a<br># Last password change &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  : Dec 15, 2024<br># Password expires &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  : Mar 15, 2025  \u2190 90 \u5929\u540e<br># Password inactive &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : never<br># Account expires &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : never<br># Minimum number of days between password change &nbsp; &nbsp; &nbsp; &nbsp; : 1<br># Maximum number of days between password change &nbsp; &nbsp; &nbsp; &nbsp; : 90<br># Number of days of warning before password expires &nbsp; &nbsp;  : 7<br>\u200b<br>### 3. \u9a8c\u8bc1 PAM \u6a21\u5757\u52a0\u8f7d<br># \u68c0\u67e5 pwquality \u6a21\u5757<br>grep pam_pwquality.so \/etc\/pam.d\/system-auth<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E8%87%AA%E5%8A%A8%E5%8C%96%E8%84%9A%E6%9C%AC\"><\/span>\u81ea\u52a8\u5316\u811a\u672c<span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><code>\/tmp\/password_policy_centos7.sh<\/code><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">#!\/bin\/bash<br>#########################################################################<br># Script Name: password_policy_centos7.sh<br># Description: CentOS 7.9 \u5bc6\u7801\u590d\u6742\u5ea6\u548c\u6709\u6548\u671f\u914d\u7f6e\u811a\u672c\uff08\u4fee\u6b63\u7248\uff09<br># Author: zhangpeng<br># Date: 2026-1-12<br># Version: 2.1<br># Changes: <br># &nbsp; - \u5bc6\u7801\u590d\u6742\u5ea6\u4e3a\"\u81f3\u5c11 3 \u79cd\u5b57\u7b26\u7c7b\u578b\"<br># &nbsp; - \u79fb\u9664\u5f3a\u5236 4 \u79cd\u5b57\u7b26\u7c7b\u578b\u7684\u9650\u5236<br>#########################################################################<br>\u200b<br># \u989c\u8272\u5b9a\u4e49<br>RED='\\033[0;31m'<br>GREEN='\\033[0;32m'<br>YELLOW='\\033[1;33m'<br>BLUE='\\033[0;34m'<br>CYAN='\\033[0;36m'<br>NC='\\033[0m'<br>\u200b<br># \u65e5\u5fd7\u51fd\u6570<br>log_info() {<br> &nbsp; &nbsp;echo -e \"${GREEN}[INFO]${NC} $1\"<br>}<br>\u200b<br>log_warn() {<br> &nbsp; &nbsp;echo -e \"${YELLOW}[WARN]${NC} $1\"<br>}<br>\u200b<br>log_error() {<br> &nbsp; &nbsp;echo -e \"${RED}[ERROR]${NC} $1\"<br>}<br>\u200b<br>log_step() {<br> &nbsp; &nbsp;echo -e \"${BLUE}[STEP]${NC} $1\"<br>}<br>\u200b<br># \u68c0\u67e5\u662f\u5426\u4e3a root \u7528\u6237<br>check_root() {<br> &nbsp; &nbsp;if [ \"$(id -u)\" -ne 0 ]; then<br> &nbsp; &nbsp; &nbsp;  log_error \"\u6b64\u811a\u672c\u5fc5\u987b\u4ee5 root \u7528\u6237\u8fd0\u884c\uff01\"<br> &nbsp; &nbsp; &nbsp; &nbsp;exit 1<br> &nbsp; &nbsp;fi<br>}<br>\u200b<br># \u68c0\u67e5\u7cfb\u7edf\u7248\u672c<br>check_system() {<br> &nbsp; &nbsp;if [ ! -f \/etc\/redhat-release ]; then<br> &nbsp; &nbsp; &nbsp;  log_error \"\u6b64\u811a\u672c\u4ec5\u652f\u6301 CentOS\/RHEL \u7cfb\u7edf\uff01\"<br> &nbsp; &nbsp; &nbsp; &nbsp;exit 1<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp;  local version=$(cat \/etc\/redhat-release | grep -oP '(?&lt;=release )\\d+')<br> &nbsp; &nbsp;if [ \"$version\" != \"7\" ]; then<br> &nbsp; &nbsp; &nbsp;  log_warn \"\u68c0\u6d4b\u5230\u7cfb\u7edf\u7248\u672c\u4e3a $version\uff0c\u6b64\u811a\u672c\u4e13\u4e3a CentOS 7.9 \u8bbe\u8ba1\"<br> &nbsp; &nbsp; &nbsp;  read -p \"\u662f\u5426\u7ee7\u7eed\u6267\u884c\uff1f(y\/n): \" choice<br> &nbsp; &nbsp; &nbsp; &nbsp;if [ \"$choice\" != \"y\" ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;exit 0<br> &nbsp; &nbsp; &nbsp; &nbsp;fi<br> &nbsp; &nbsp;fi<br>}<br>\u200b<br># \u83b7\u53d6\u666e\u901a\u7528\u6237\u5217\u8868<br>get_normal_users() {<br> &nbsp; &nbsp;awk -F: '$3&gt;=1000 &amp;&amp; $3!=65534 {print $1\":\"$3\":\"$6}' \/etc\/passwd<br>}<br>\u200b<br># \u663e\u793a\u666e\u901a\u7528\u6237\u5217\u8868<br>show_normal_users() {<br> &nbsp;  local users=$(get_normal_users)<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;if [ -z \"$users\" ]; then<br> &nbsp; &nbsp; &nbsp;  log_warn \"\u7cfb\u7edf\u4e2d\u6ca1\u6709\u666e\u901a\u7528\u6237\uff08UID &gt;= 1000\uff09\"<br> &nbsp; &nbsp; &nbsp;  return 1<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;echo -e \"${CYAN}==========================================\"<br> &nbsp; &nbsp;echo -e \"  \u68c0\u6d4b\u5230\u7684\u666e\u901a\u7528\u6237\u5217\u8868\"<br> &nbsp; &nbsp;echo -e \"==========================================${NC}\"<br> &nbsp;  printf \"%-20s %-10s %-30s\\n\" \"\u7528\u6237\u540d\" \"UID\" \"\u5bb6\u76ee\u5f55\"<br> &nbsp; &nbsp;echo \"------------------------------------------------------------------\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;while IFS=: read -r username uid homedir; do<br> &nbsp; &nbsp; &nbsp;  printf \"%-20s %-10s %-30s\\n\" \"$username\" \"$uid\" \"$homedir\"<br> &nbsp; &nbsp;done &lt;&lt;&lt; \"$users\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"------------------------------------------------------------------\"<br> &nbsp;  local user_count=$(echo \"$users\" | wc -l)<br> &nbsp; &nbsp;echo -e \"\u603b\u8ba1: ${GREEN}$user_count${NC} \u4e2a\u666e\u901a\u7528\u6237\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp;  return 0<br>}<br>\u200b<br># \u5b89\u88c5\u5fc5\u8981\u8f6f\u4ef6\u5305<br>install_packages() {<br> &nbsp;  log_step \"\u6b65\u9aa4 1\/5: \u68c0\u67e5\u5e76\u5b89\u88c5\u5fc5\u8981\u8f6f\u4ef6\u5305...\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;if rpm -qa | grep -q libpwquality; then<br> &nbsp; &nbsp; &nbsp;  log_info \"libpwquality \u5df2\u5b89\u88c5\"<br> &nbsp; &nbsp;else<br> &nbsp; &nbsp; &nbsp;  log_info \"\u6b63\u5728\u5b89\u88c5 libpwquality...\"<br> &nbsp; &nbsp; &nbsp;  yum install -y libpwquality<br> &nbsp; &nbsp; &nbsp; &nbsp;if [ $? -eq 0 ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_info \"libpwquality \u5b89\u88c5\u6210\u529f\"<br> &nbsp; &nbsp; &nbsp; &nbsp;else<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_error \"libpwquality \u5b89\u88c5\u5931\u8d25\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;exit 1<br> &nbsp; &nbsp; &nbsp; &nbsp;fi<br> &nbsp; &nbsp;fi<br>}<br>\u200b<br># \u5907\u4efd\u914d\u7f6e\u6587\u4ef6<br>backup_configs() {<br> &nbsp;  log_step \"\u6b65\u9aa4 2\/5: \u5907\u4efd\u539f\u914d\u7f6e\u6587\u4ef6...\"<br> &nbsp; &nbsp;<br> &nbsp;  local backup_dir=\"\/root\/password_policy_backup_$(date +%Y%m%d_%H%M%S)\"<br> &nbsp; &nbsp;mkdir -p \"$backup_dir\"<br> &nbsp; &nbsp;<br> &nbsp;  local files=(<br> &nbsp; &nbsp; &nbsp; &nbsp;\"\/etc\/pam.d\/system-auth\"<br> &nbsp; &nbsp; &nbsp; &nbsp;\"\/etc\/pam.d\/password-auth\"<br> &nbsp; &nbsp; &nbsp; &nbsp;\"\/etc\/security\/pwquality.conf\"<br> &nbsp; &nbsp; &nbsp; &nbsp;\"\/etc\/login.defs\"<br> &nbsp;  )<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;for file in \"${files[@]}\"; do<br> &nbsp; &nbsp; &nbsp; &nbsp;if [ -f \"$file\" ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cp \"$file\" \"$backup_dir\/\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_info \"\u5df2\u5907\u4efd: $file -&gt; $backup_dir\/\"<br> &nbsp; &nbsp; &nbsp; &nbsp;fi<br> &nbsp; &nbsp;done<br> &nbsp; &nbsp;<br> &nbsp;  log_info \"\u5907\u4efd\u76ee\u5f55: $backup_dir\"<br>}<br>\u200b<br># \u2705 \u4fee\u6539\u540e\u7684 PAM \u914d\u7f6e<br>configure_pam() {<br> &nbsp;  log_step \"\u6b65\u9aa4 3\/5: \u914d\u7f6e PAM \u5bc6\u7801\u590d\u6742\u5ea6\u7b56\u7565...\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;# \u914d\u7f6e system-auth<br> &nbsp;  log_info \"\u914d\u7f6e \/etc\/pam.d\/system-auth...\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;# \u5220\u9664\u65e7\u7684 pam_pwquality.so \u884c<br> &nbsp; &nbsp;sed -i '\/^password.*pam_pwquality.so\/d' \/etc\/pam.d\/system-auth<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;# \u2705 \u53ea\u4f7f\u7528 minclass=3\uff0c\u4e0d\u5f3a\u5236\u6bcf\u79cd\u5b57\u7b26\u7c7b\u578b<br> &nbsp; &nbsp;sed -i '\/^password\/i\\password &nbsp;  requisite &nbsp; &nbsp; pam_pwquality.so try_first_pass retry=3 authtok_type= minlen=8 minclass=3 enforce_for_root' \/etc\/pam.d\/system-auth<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;# \u5220\u9664\u91cd\u590d\u884c<br> &nbsp; &nbsp;awk '!seen[$0]++' \/etc\/pam.d\/system-auth &gt; \/tmp\/system-auth.tmp<br> &nbsp; &nbsp;mv \/tmp\/system-auth.tmp \/etc\/pam.d\/system-auth<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;# \u79fb\u9664 remember \u53c2\u6570\uff08\u5982\u679c\u5b58\u5728\uff09<br> &nbsp; &nbsp;sed -i 's\/\\s*remember=[0-9]*\/\/g' \/etc\/pam.d\/system-auth<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;# \u540c\u6b65\u5230 password-auth<br> &nbsp;  log_info \"\u540c\u6b65\u914d\u7f6e\u5230 \/etc\/pam.d\/password-auth...\"<br> &nbsp; &nbsp;cp \/etc\/pam.d\/system-auth \/etc\/pam.d\/password-auth<br> &nbsp; &nbsp;<br> &nbsp;  log_info \"PAM \u914d\u7f6e\u5b8c\u6210\"<br>}<br>\u200b<br># \u2705 \u4fee\u6539\u540e\u7684 pwquality \u914d\u7f6e<br>configure_pwquality() {<br> &nbsp;  log_step \"\u6b65\u9aa4 4\/5: \u914d\u7f6e \/etc\/security\/pwquality.conf...\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;cat &gt; \/etc\/security\/pwquality.conf &lt;&lt; 'EOF'<br># Configuration for systemwide password quality limits<br>\u200b<br># Number of characters in the new password that must not be present in the old password.<br>difok = 3<br>\u200b<br># Minimum acceptable size for the new password<br>minlen = 8<br>\u200b<br># \u2705 \u4e0d\u5f3a\u5236\u8981\u6c42\u6bcf\u79cd\u5b57\u7b26\u7c7b\u578b\uff0c\u53ea\u8981\u6c42\u81f3\u5c11 3 \u79cd\u5373\u53ef<br># The maximum credit for having digits in the new password.<br># dcredit = 1<br>\u200b<br># The maximum credit for having uppercase characters in the new password.<br># ucredit = 1<br>\u200b<br># The maximum credit for having lowercase characters in the new password.<br># lcredit = 1<br>\u200b<br># The maximum credit for having other characters in the new password.<br># ocredit = 1<br>\u200b<br># The minimum number of required classes of characters for the new password<br># \u2705 \u81f3\u5c11 3 \u79cd\u5b57\u7b26\u7c7b\u578b\uff08\u5927\u5199\u3001\u5c0f\u5199\u3001\u6570\u5b57\u3001\u7279\u6b8a\u5b57\u7b26\uff09<br>minclass = 3<br>\u200b<br># Whether to check for the words from the passwd entry GECOS string of the user<br>usercheck = 1<br>\u200b<br># Whether to check for the words from the cracklib dictionary<br>dictcheck = 1<br>\u200b<br># Enforces pwquality checks on the root user password.<br>enforce_for_root<br>EOF<br>\u200b<br> &nbsp;  log_info \"pwquality.conf \u914d\u7f6e\u5b8c\u6210\"<br>}<br>\u200b<br># \u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f<br>configure_password_aging() {<br> &nbsp;  log_step \"\u6b65\u9aa4 5\/5: \u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f\u7b56\u7565...\"<br> &nbsp; &nbsp;<br> &nbsp;  log_info \"\u914d\u7f6e \/etc\/login.defs...\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;sed -i 's\/^PASS_MAX_DAYS.*\/PASS_MAX_DAYS &nbsp; 90\/' \/etc\/login.defs<br> &nbsp; &nbsp;sed -i 's\/^PASS_MIN_DAYS.*\/PASS_MIN_DAYS &nbsp; 0\/' \/etc\/login.defs<br> &nbsp; &nbsp;sed -i 's\/^PASS_WARN_AGE.*\/PASS_WARN_AGE &nbsp; 7\/' \/etc\/login.defs<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;if ! grep -q \"^PASS_MIN_LEN\" \/etc\/login.defs; then<br> &nbsp; &nbsp; &nbsp; &nbsp;echo \"PASS_MIN_LEN &nbsp;  8\" &gt;&gt; \/etc\/login.defs<br> &nbsp; &nbsp;else<br> &nbsp; &nbsp; &nbsp; &nbsp;sed -i 's\/^PASS_MIN_LEN.*\/PASS_MIN_LEN &nbsp;  8\/' \/etc\/login.defs<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp;  log_info \"login.defs \u914d\u7f6e\u5b8c\u6210\"<br> &nbsp; &nbsp;<br> &nbsp;  log_info \"\u4e3a root \u7528\u6237\u8bbe\u7f6e\u5bc6\u7801\u6709\u6548\u671f...\"<br> &nbsp;  chage -M 90 -m 0 -W 7 root<br> &nbsp;  log_info \"\u91cd\u7f6e root \u5bc6\u7801\u4fee\u6539\u65f6\u95f4\u4e3a\u4eca\u5929...\"<br> &nbsp;  chage -d $(( $(date +%s) \/ 86400 )) root<br> &nbsp;  log_success \"\u5df2\u5bf9 root \u7528\u6237\u5e94\u7528\u5bc6\u7801\u7b56\u7565\u5e76\u8bbe\u7f6e\u6709\u6548\u671f90\u5929\"<br>\u200b<br> &nbsp; &nbsp;<br> &nbsp;  local users=$(get_normal_users)<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;if [ -z \"$users\" ]; then<br> &nbsp; &nbsp; &nbsp;  log_warn \"\u672a\u627e\u5230\u666e\u901a\u7528\u6237\uff08UID &gt;= 1000\uff09\uff0c\u8df3\u8fc7\u666e\u901a\u7528\u6237\u914d\u7f6e\"<br> &nbsp; &nbsp; &nbsp;  return<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  show_normal_users<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo -e \"${YELLOW}\u662f\u5426\u4e3a\u4ee5\u4e0a\u666e\u901a\u7528\u6237\u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f\uff1f${NC}\"<br> &nbsp; &nbsp;echo \"  [1] \u662f - \u4e3a\u6240\u6709\u666e\u901a\u7528\u6237\u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f 90 \u5929\"<br> &nbsp; &nbsp;echo \"  [2] \u5426 - \u8df3\u8fc7\u666e\u901a\u7528\u6237\u914d\u7f6e\uff08\u4ec5\u914d\u7f6e root\uff09\"<br> &nbsp; &nbsp;echo \"  [3] \u81ea\u5b9a\u4e49 - \u624b\u52a8\u9009\u62e9\u8981\u914d\u7f6e\u7684\u7528\u6237\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  read -p \"\u8bf7\u9009\u62e9 [1-3]: \" user_choice<br> &nbsp; &nbsp;<br> &nbsp;  case $user_choice in<br> &nbsp; &nbsp; &nbsp; &nbsp;1)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_info \"\u4e3a\u6240\u6709\u666e\u901a\u7528\u6237\u8bbe\u7f6e\u5bc6\u7801\u6709\u6548\u671f...\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  local user_count=0<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;while IFS=: read -r username uid homedir; do<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  chage -M 90 -m 0 -W 7 \"$username\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_info \"  \u2713 \u5df2\u8bbe\u7f6e\u7528\u6237: $username\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ((user_count++))<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;done &lt;&lt;&lt; \"$users\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_info \"\u5171\u8bbe\u7f6e $user_count \u4e2a\u666e\u901a\u7528\u6237\u7684\u5bc6\u7801\u6709\u6548\u671f\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ;;<br> &nbsp; &nbsp; &nbsp; &nbsp;2)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_warn \"\u5df2\u8df3\u8fc7\u666e\u901a\u7528\u6237\u5bc6\u7801\u6709\u6548\u671f\u914d\u7f6e\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ;;<br> &nbsp; &nbsp; &nbsp; &nbsp;3)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  configure_selected_users \"$users\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ;;<br> &nbsp; &nbsp; &nbsp;  *)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_warn \"\u65e0\u6548\u9009\u62e9\uff0c\u8df3\u8fc7\u666e\u901a\u7528\u6237\u5bc6\u7801\u6709\u6548\u671f\u914d\u7f6e\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ;;<br> &nbsp; &nbsp;esac<br>}<br>\u200b<br># \u4e3a\u9009\u5b9a\u7684\u7528\u6237\u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f<br>configure_selected_users() {<br> &nbsp;  local users=\"$1\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  log_info \"\u8bf7\u8f93\u5165\u8981\u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f\u7684\u7528\u6237\u540d\uff0c\u591a\u4e2a\u7528\u6237\u7528\u7a7a\u683c\u5206\u9694\"<br> &nbsp;  log_info \"\u53ef\u7528\u7528\u6237: $(echo \"$users\" | cut -d: -f1 | tr '\\n' ' ')\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  read -p \"\u7528\u6237\u5217\u8868: \" selected_users<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;if [ -z \"$selected_users\" ]; then<br> &nbsp; &nbsp; &nbsp;  log_warn \"\u672a\u9009\u62e9\u4efb\u4f55\u7528\u6237\uff0c\u8df3\u8fc7\u914d\u7f6e\"<br> &nbsp; &nbsp; &nbsp;  return<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp;  local configured_count=0<br> &nbsp;  local failed_users=\"\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;for username in $selected_users; do<br> &nbsp; &nbsp; &nbsp; &nbsp;if echo \"$users\" | grep -q \"^${username}:\"; then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  chage -M 90 -m 0 -W 7 \"$username\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_info \"  \u2713 \u5df2\u8bbe\u7f6e\u7528\u6237: $username\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ((configured_count++))<br> &nbsp; &nbsp; &nbsp; &nbsp;else<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  log_warn \"  \u2717 \u7528\u6237 $username \u4e0d\u5b58\u5728\u6216\u4e0d\u662f\u666e\u901a\u7528\u6237\uff0c\u8df3\u8fc7\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;failed_users=\"$failed_users $username\"<br> &nbsp; &nbsp; &nbsp; &nbsp;fi<br> &nbsp; &nbsp;done<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  log_info \"\u6210\u529f\u914d\u7f6e $configured_count \u4e2a\u7528\u6237\u7684\u5bc6\u7801\u6709\u6548\u671f\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;if [ -n \"$failed_users\" ]; then<br> &nbsp; &nbsp; &nbsp;  log_warn \"\u4ee5\u4e0b\u7528\u6237\u914d\u7f6e\u5931\u8d25:$failed_users\"<br> &nbsp; &nbsp;fi<br>}<br>\u200b<br># \u9a8c\u8bc1\u914d\u7f6e<br>\u200b<br>verify_configuration() {<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  log_step \"===== \u914d\u7f6e\u9a8c\u8bc1 =====\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo -e \"${BLUE}[1] PAM \u914d\u7f6e:${NC}\"<br> &nbsp; &nbsp;grep pam_pwquality.so \/etc\/pam.d\/system-auth<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo -e \"${BLUE}[2] pwquality \u914d\u7f6e:${NC}\"<br> &nbsp; &nbsp;cat \/etc\/security\/pwquality.conf | grep -v '^#' | grep -v '^$'<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo -e \"${BLUE}[3] \u5bc6\u7801\u6709\u6548\u671f\u914d\u7f6e:${NC}\"<br> &nbsp; &nbsp;grep PASS_ \/etc\/login.defs | grep -v '^#'<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo -e \"${BLUE}[4] root \u7528\u6237\u5bc6\u7801\u7b56\u7565:${NC}\"<br> &nbsp;  chage -l root || chage -l root | grep -E \"(Last password change|Password expires|Maximum number|Minimum number|Number of days of warning)\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo -e \"${BLUE}[5] \u5df2\u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f\u7684\u666e\u901a\u7528\u6237:${NC}\"<br> &nbsp;  local users=$(get_normal_users)<br> &nbsp; &nbsp;if [ -n \"$users\" ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp; &nbsp;  printf \"%-20s %-15s %-15s %-15s\\n\" \"\u7528\u6237\u540d\" \"\u6700\u5927\u6709\u6548\u671f\" \"\u6700\u5c0f\u95f4\u9694\" \"\u8b66\u544a\u5929\u6570\"<br> &nbsp; &nbsp; &nbsp; &nbsp;echo \"---------------------------------------------------------------\"<br> &nbsp; &nbsp; &nbsp; &nbsp;while IFS=: read -r username uid homedir; do<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  local max_days=$(chage -l \"$username\" | grep \"Maximum\" | awk -F: '{print $2}' | xargs)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  local min_days=$(chage -l \"$username\" | grep \"Minimum\" | awk -F: '{print $2}' | xargs)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  local warn_days=$(chage -l \"$username\" | grep \"warning\" | awk -F: '{print $2}' | xargs)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if [ \"$max_days\" = \"90\" ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  printf \"%-20s %-15s %-15s %-15s\\n\" \"$username\" \"$max_days\" \"$min_days\" \"$warn_days\"<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;fi<br> &nbsp; &nbsp; &nbsp; &nbsp;done &lt;&lt;&lt; \"$users\"<br> &nbsp; &nbsp; &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;else<br> &nbsp; &nbsp; &nbsp;  log_info \"\u65e0\u666e\u901a\u7528\u6237\"<br> &nbsp; &nbsp; &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;fi<br>}<br>\u200b<br># \u6d4b\u8bd5\u5bc6\u7801\u590d\u6742\u5ea6<br>test_password_policy() {<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  log_step \"===== \u5bc6\u7801\u590d\u6742\u5ea6\u6d4b\u8bd5 =====\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp;  read -p \"\u662f\u5426\u8fdb\u884c\u5bc6\u7801\u590d\u6742\u5ea6\u6d4b\u8bd5\uff1f(y\/n): \" do_test<br> &nbsp; &nbsp;if [ \"$do_test\" != \"y\" ]; then<br> &nbsp; &nbsp; &nbsp;  log_info \"\u8df3\u8fc7\u6d4b\u8bd5\"<br> &nbsp; &nbsp; &nbsp;  return<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp;  local test_user=\"testpwd_$(date +%s)\"<br> &nbsp; &nbsp;<br> &nbsp;  log_info \"\u521b\u5efa\u6d4b\u8bd5\u7528\u6237: $test_user\"<br> &nbsp;  useradd \"$test_user\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  log_info \"\u8bf7\u4e3a\u6d4b\u8bd5\u7528\u6237\u8bbe\u7f6e\u5bc6\u7801\uff0c\u5efa\u8bae\u6d4b\u8bd5\u4ee5\u4e0b\u5bc6\u7801\uff1a\"<br> &nbsp; &nbsp;echo \"  \u2705 Abcd1234 &nbsp; &nbsp;  (3\u79cd: \u5927\u5199+\u5c0f\u5199+\u6570\u5b57)\"<br> &nbsp; &nbsp;echo \"  \u2705 [O_GtbyX &nbsp; &nbsp;  (3\u79cd: \u5927\u5199+\u5c0f\u5199+\u7279\u6b8a\u5b57\u7b26)\"<br> &nbsp; &nbsp;echo \"  \u2705 test@123 &nbsp; &nbsp;  (3\u79cd: \u5c0f\u5199+\u6570\u5b57+\u7279\u6b8a\u5b57\u7b26)\"<br> &nbsp; &nbsp;echo \"  \u2705 Test@123 &nbsp; &nbsp;  (4\u79cd: \u5927\u5199+\u5c0f\u5199+\u6570\u5b57+\u7279\u6b8a\u5b57\u7b26)\"<br> &nbsp; &nbsp;echo \"  \u274c 123456 &nbsp; &nbsp; &nbsp;  (1\u79cd: \u53ea\u6709\u6570\u5b57)\"<br> &nbsp; &nbsp;echo \"  \u274c abcdefgh &nbsp; &nbsp;  (1\u79cd: \u53ea\u6709\u5c0f\u5199)\"<br> &nbsp; &nbsp;echo \"  \u274c Test123 &nbsp; &nbsp; &nbsp; (2\u79cd: \u5927\u5199+\u5c0f\u5199+\u6570\u5b57\uff0c\u4f46\u53ea\u67092\u79cd)\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp;  passwd \"$test_user\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  log_info \"\u67e5\u770b\u6d4b\u8bd5\u7528\u6237\u5bc6\u7801\u7b56\u7565:\"<br> &nbsp;  chage -l \"$test_user\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  read -p \"\u662f\u5426\u5220\u9664\u6d4b\u8bd5\u7528\u6237 $test_user\uff1f(y\/n): \" do_delete<br> &nbsp; &nbsp;if [ \"$do_delete\" = \"y\" ]; then<br> &nbsp; &nbsp; &nbsp;  userdel -r \"$test_user\" 2&gt;\/dev\/null<br> &nbsp; &nbsp; &nbsp;  log_info \"\u5df2\u5220\u9664\u6d4b\u8bd5\u7528\u6237: $test_user\"<br> &nbsp; &nbsp;else<br> &nbsp; &nbsp; &nbsp;  log_warn \"\u4fdd\u7559\u6d4b\u8bd5\u7528\u6237: $test_user\"<br> &nbsp; &nbsp; &nbsp;  log_warn \"\u624b\u52a8\u5220\u9664\u547d\u4ee4: userdel -r $test_user\"<br> &nbsp; &nbsp;fi<br>}<br>\u200b<br># \u663e\u793a\u914d\u7f6e\u6458\u8981<br>show_summary() {<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;echo \"==========================================\"<br> &nbsp;  log_info \"\u914d\u7f6e\u5b8c\u6210\u6458\u8981\"<br> &nbsp; &nbsp;echo \"==========================================\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;echo \"\u2705 \u5bc6\u7801\u590d\u6742\u5ea6\u8981\u6c42:\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u6700\u5c0f\u957f\u5ea6: 8 \u4f4d\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u5b57\u7b26\u7c7b\u578b: \u81f3\u5c11 3 \u79cd\uff08\u5927\u5199\u3001\u5c0f\u5199\u3001\u6570\u5b57\u3001\u7279\u6b8a\u5b57\u7b26\uff09\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u793a\u4f8b\u5bc6\u7801:\"<br> &nbsp; &nbsp;echo \" &nbsp; &nbsp; \u2022 Abcd1234 &nbsp; &nbsp; &nbsp; (\u5927\u5199+\u5c0f\u5199+\u6570\u5b57)\"<br> &nbsp; &nbsp;echo \" &nbsp; &nbsp; \u2022 [O_GtbyX &nbsp; &nbsp; &nbsp; (\u5927\u5199+\u5c0f\u5199+\u7279\u6b8a\u5b57\u7b26)\"<br> &nbsp; &nbsp;echo \" &nbsp; &nbsp; \u2022 test@123 &nbsp; &nbsp; &nbsp; (\u5c0f\u5199+\u6570\u5b57+\u7279\u6b8a\u5b57\u7b26)\"<br> &nbsp; &nbsp;echo \" &nbsp; &nbsp; \u2022 Test@123 &nbsp; &nbsp; &nbsp; (\u5927\u5199+\u5c0f\u5199+\u6570\u5b57+\u7279\u6b8a\u5b57\u7b26)\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u7981\u6b62\u4f7f\u7528: \u7528\u6237\u540d\u3001\u5b57\u5178\u5355\u8bcd\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u5bf9 root \u751f\u6548: \u662f\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u5386\u53f2\u5bc6\u7801\u9650\u5236: \u65e0\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;echo \"\u2705 \u5bc6\u7801\u6709\u6548\u671f\u7b56\u7565:\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u6700\u5927\u6709\u6548\u671f: 90 \u5929\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u6700\u5c0f\u4fee\u6539\u95f4\u9694: 0 \u5929 (\u968f\u65f6\u53ef\u6539)\"<br> &nbsp; &nbsp;echo \" &nbsp; - \u8fc7\u671f\u524d\u8b66\u544a: 7 \u5929\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;echo \"\u2705 \u5df2\u751f\u6548\u7528\u6237:\"<br> &nbsp; &nbsp;echo \" &nbsp; - root \u7528\u6237: \u5df2\u8bbe\u7f6e\"<br> &nbsp; &nbsp;<br> &nbsp;  local users=$(get_normal_users)<br> &nbsp;  local configured_count=0<br> &nbsp; &nbsp;if [ -n \"$users\" ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp;while IFS=: read -r username uid homedir; do<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  local max_days=$(chage -l \"$username\" | grep \"Maximum\" | awk -F: '{print $2}' | xargs)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if [ \"$max_days\" = \"90\" ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  ((configured_count++))<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;fi<br> &nbsp; &nbsp; &nbsp; &nbsp;done &lt;&lt;&lt; \"$users\"<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp;  local total_users=$(echo \"$users\" | wc -l)<br> &nbsp;  [ -z \"$users\" ] &amp;&amp; total_users=0<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \" &nbsp; - \u666e\u901a\u7528\u6237: $configured_count\/$total_users \u4e2a\u5df2\u914d\u7f6e\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;echo \"==========================================\"<br>}<br>\u200b<br># \u663e\u793a\u672a\u914d\u7f6e\u7684\u7528\u6237<br>show_unconfigured_users() {<br> &nbsp;  local users=$(get_normal_users)<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;if [ -z \"$users\" ]; then<br> &nbsp; &nbsp; &nbsp;  return<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp;  local unconfigured_users=\"\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;while IFS=: read -r username uid homedir; do<br> &nbsp; &nbsp; &nbsp;  local max_days=$(chage -l \"$username\" | grep \"Maximum\" | awk -F: '{print $2}' | xargs)<br> &nbsp; &nbsp; &nbsp; &nbsp;if [ \"$max_days\" != \"90\" ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;unconfigured_users=\"$unconfigured_users $username\"<br> &nbsp; &nbsp; &nbsp; &nbsp;fi<br> &nbsp; &nbsp;done &lt;&lt;&lt; \"$users\"<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;if [ -n \"$unconfigured_users\" ]; then<br> &nbsp; &nbsp; &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp; &nbsp;  log_warn \"\u4ee5\u4e0b\u666e\u901a\u7528\u6237\u672a\u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f:\"<br> &nbsp; &nbsp; &nbsp; &nbsp;echo \" &nbsp; $unconfigured_users\"<br> &nbsp; &nbsp; &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp; &nbsp;  log_info \"\u5982\u9700\u914d\u7f6e\uff0c\u53ef\u624b\u52a8\u6267\u884c:\"<br> &nbsp; &nbsp; &nbsp; &nbsp;for user in $unconfigured_users; do<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;echo \" &nbsp; chage -M 90 -m 0 -W 7 $user\"<br> &nbsp; &nbsp; &nbsp; &nbsp;done<br> &nbsp; &nbsp;fi<br>}<br>\u200b<br># \u4e3b\u51fd\u6570<br>main() {<br> &nbsp; &nbsp;echo \"==========================================\"<br> &nbsp; &nbsp;echo \"  CentOS 7.9 \u5bc6\u7801\u590d\u6742\u5ea6\u914d\u7f6e\u811a\u672c v2.1\"<br> &nbsp; &nbsp;echo \"==========================================\"<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp;  check_root<br> &nbsp;  check_system<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp;  read -p \"\u5373\u5c06\u5f00\u59cb\u914d\u7f6e\uff0c\u662f\u5426\u7ee7\u7eed\uff1f(y\/n): \" confirm<br> &nbsp; &nbsp;if [ \"$confirm\" != \"y\" ]; then<br> &nbsp; &nbsp; &nbsp;  log_info \"\u7528\u6237\u53d6\u6d88\u64cd\u4f5c\"<br> &nbsp; &nbsp; &nbsp; &nbsp;exit 0<br> &nbsp; &nbsp;fi<br> &nbsp; &nbsp;<br> &nbsp; &nbsp;echo \"\"<br> &nbsp; &nbsp;<br> &nbsp;  install_packages<br> &nbsp;  backup_configs<br> &nbsp;  configure_pam<br> &nbsp;  configure_pwquality<br> &nbsp;  configure_password_aging<br> &nbsp;  verify_configuration<br> &nbsp;  test_password_policy<br> &nbsp;  show_summary<br> &nbsp;  show_unconfigured_users<br> &nbsp; &nbsp;<br> &nbsp;  log_info \"\u6240\u6709\u914d\u7f6e\u5df2\u5b8c\u6210\uff01\"<br> &nbsp;  log_warn \"\u5efa\u8bae\u91cd\u542f\u7cfb\u7edf\u540e\u518d\u6b21\u9a8c\u8bc1\u914d\u7f6e\"<br>}<br>\u200b<br>main \"$@\"<br>\u200b<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E9%85%8D%E7%BD%AE%E5%90%8E%E9%AA%8C%E8%AF%81%E6%B8%85%E5%8D%95\"><\/span><strong>\u914d\u7f6e\u540e\u9a8c\u8bc1\u6e05\u5355<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n\n\n\n<pre class=\"wp-block-preformatted\"># \u2705 \u68c0\u67e5 PAM \u914d\u7f6e<br>grep pam_pwquality.so \/etc\/pam.d\/system-auth<br># \u2705 \u68c0\u67e5 pwquality \u914d\u7f6e<br>cat \/etc\/security\/pwquality.conf | grep -v '^#' | grep -v '^$'<br># \u2705 \u68c0\u67e5\u5bc6\u7801\u6709\u6548\u671f<br>grep PASS_ \/etc\/login.defs | grep -v '^#'<br># \u2705 \u68c0\u67e5root\u7528\u6237\u5bc6\u7801\u7b56\u7565<br>chage -l root<br>\u200b<br># \u2705 \u6d4b\u8bd5\u5bc6\u7801\u590d\u6742\u5ea6\uff08\u521b\u5efa\u6d4b\u8bd5\u7528\u6237\uff09<br>useradd testpwd<br>passwd testpwd &nbsp;# \u5c1d\u8bd5\u8f93\u5165 Test@123<br># \u2705 \u68c0\u67e5\u7528\u6237\u5bc6\u7801\u7b56\u7565<br>chage -l testpwd<br># \u4e3a\u5355\u4e2a\u7528\u6237\u914d\u7f6e\u5bc6\u7801\u6709\u6548\u671f<br>chage -M 90 -m 0 -W 7 username<br># \u6279\u91cf\u914d\u7f6e\u591a\u4e2a\u7528\u6237<br>for user in user1 user2 user3; do<br> &nbsp;  chage -M 90 -m 0 -W 7 \"$user\"<br> &nbsp; &nbsp;echo \"\u5df2\u914d\u7f6e\u7528\u6237: $user\"<br>done<br># \u2705 \u6e05\u7406\u6d4b\u8bd5\u7528\u6237<br>userdel -r testpwd<\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/typora-zp.oss-cn-shanghai.aliyuncs.com\/typora20260112162310523.png\" alt=\"image-20260112162303384\"\/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>\u8868\u683c17\u6761 \u670d\u52a1\u5668\u672a\u914d\u7f6e\u5bc6\u7801\u590d\u6742\u5ea6\u548c\u5bc6\u7801\u6709\u6548\u671f\uff0c\u53ef\u80fd\u4f1a\u88ab\u8bbe\u7f6e\u4e3a\u5f31\u53e3\u4ee4\u548c\u957f\u65f6\u95f4\u4f7f\u7528\uff0c\u6076\u610f\u4eba\u5458\u53ef\u80fd\u901a\u8fc7\u731c\u89e3\u6216\u66b4\u529b\u7834 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3146","post","type-post","status-publish","format-standard","hentry","category-vxhs888p"],"_links":{"self":[{"href":"https:\/\/linuxjk.cn\/index.php?rest_route=\/wp\/v2\/posts\/3146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/linuxjk.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxjk.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxjk.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxjk.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3146"}],"version-history":[{"count":1,"href":"https:\/\/linuxjk.cn\/index.php?rest_route=\/wp\/v2\/posts\/3146\/revisions"}],"predecessor-version":[{"id":3147,"href":"https:\/\/linuxjk.cn\/index.php?rest_route=\/wp\/v2\/posts\/3146\/revisions\/3147"}],"wp:attachment":[{"href":"https:\/\/linuxjk.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxjk.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxjk.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}