如何设置具有强度的密码？

发布网友 发布时间：2022-02-25 02:47

我来回答

共4个回答

热心网友 时间：2022-02-25 04:16

找到password requisite pam_cracklib.so在后面可以加 difok=x（要x个不同字符） minlen=x（最小密码长度） ucredit=-x（最少x个大写字母） lcredit=-x（最少x个小写字母） dcredit=-x （最少x个数字）dictpath=/usr/share/cracklib/pw_dict时间在[root@localhost ~]# vim /etc/login.defs，PASS_MAX_DAYS  99999 （最大什么时候过期）PASS_MIN_DAYS   0            （最小什么事后过期）PASS_MIN_LEN  5 （密码最小长度）PASS_WARN_AGE   7            （警告天数）我们在使用linux系统设置密码的时候，经常遇到这样的问题，系统提示：您的密码太简单，或者您的密码是字典的一部分。那么系统是如何实现对用户的密码的复杂度的检查的呢？系统对密码的控制是有两部分(我知道的)组成：
1 cracklib
2 login.defs
声明：login.defs主要是控制密码的有效期。对密码进行时间管理。此处不细谈login.defs   --shadow password suite configuration，pam_cracklib.so 才是控制密码复杂度的关键文件
redhat公司专门开发了cracklib这个安装包来判断密码的复杂度可以rpm -ql cracklib查看
密码的复杂度的判断是通过pam模块控制来实现的，具体的模块是pam_cracklibpam_cracklib 的参数介绍：debug，This option makes the mole write information to syslog(3) indicating the behavior of the mole (this option does not write password information to the log file).
type=XXX，The default action is for the mole to use the following prompts when requesting passwords: "New UNIX password: " and "Retype UNIX password: ". The default word UNIX can be replaced with this option. retry=N，Prompt user at most N times before returning with error. The default is 1 ，difok=N，This argument will change the default of 5 for the number of characters in the new password that must not be present in the old password. In addition, if 1/2 of the characters in the new password are different then the new password will be accepted anyway.
difignore=N，How many characters should the password have before difok will be ignored. The default is 23. minlen=N，The minimum acceptable size for the new password (plus one if credits are not disabled which is the default). In addition to the number of characters in the new password, credit (of +1 in length) is given for each different kind of character (other, upper, lower and digit). The default for this parameter is 9 which is good for a old style UNIX password all of the same type of character but may be too low to exploit the added security of a md5 system. Note that there is a pair of length limits in Cracklib itself, a "way too short" limit of 4 which is hard coded in and a defined limit (6) that will be checked without reference to minlen. If you want to allow passwords as short as 5 characters you should not use this mole. dcredit=N(N >= 0) This is the maximum credit for having digits in the new password. If you have less than or N digits, each digit will count +1 towards meeting the current minlen value. The default for dcredit is 1 which is the recommended value for minlen less than 10.(N < 0) This is the minimum number of digits that must be met for a new password.ucredit=N，(N >= 0) This is the maximum credit for having upper case letters in the new password. If you have less than or N upper case letters each letter will count +1 towards meeting the current minlen value. The default for ucredit is 1 which is the recommended value for minlen less than 10.(N > 0) This is the minimum number of upper case letters that must be met for a new password.lcredit=N(N >= 0) This is the maximum credit for having lower case letters in the new password. If you have less than or N lower case letters, each letter will count +1 towards meeting the current minlen value. The default for lcredit is 1 which is the recommended value for minlen less than 10，(N < 0) This is the minimum number of lower case letters that must be met for a new password.ocredit=N，(N >= 0) This is the maximum credit for having other characters in the new password. If you have less than or N other characters, each character will count +1 towards meeting the current minlen value. The default for ocredit is 1 which is the recommended value for minlen less than 10.(N < 0) This is the minimum number of other characters that must be met for a new password.use_authtok，This argument is used to force the mole to not prompt the user for a new password but use the one provided by the previously stacked password mole. dictpath=/path/to/dic，Path to the cracklib dictionaries. dictpath=/path/to/dict //注：密码字典，这个是验证用户的密码是否是字典一部分的关键。

热心网友 时间：2022-02-25 05:34

一、使用非生日和电话号码的复杂数字加字母，如科学常数、超越数的值（pi用烂了，至少用e）、某年月日某股票的建仓价格。例：sqrt21414 0522sh600028738强度一般，但自己不容易忘记（忘了也可以查）

二、把12345之类的简单密码用自制密钥加密，如找一首近体诗，假设是五言，则每一句每个字对应一个数字，然后用该字的拼音首字母与数字组合出一个字符串形成密码，最后可用一个0-1来表示是平起句还是仄起句。例：林暗草惊风，将军夜引弓。1 2 3 4 5 1 2 3 4 5

可生成两串密码：l1a2c3j5f50j1j2y3y4g50同理可继续生成，大家试试后两句“平明寻白羽，没在石棱中”。密钥可替换为格言警句，字符也可以用字母。

三、利用足够大的数的素因子，自行百度RSA算法，但需要存储那些数字，实用性较低。

热心网友 时间：2022-02-25 07:09

设置密码强度不够是因为密码设置的太短，也有可能安全级别不够。增加密码长度，增加一些字母试试

字母相近，数字相近，都会显示强度不高。可将字母和数字错位排列，能提高密码强度，例如K43C52H74。但你设置的密码要方便你记忆

热心网友 时间：2022-02-25 09:00

密码要点就是长……参考xkcd.xom/936，密码correct horse battery staple的信息熵高于塞了一堆奇怪符号的短密码。所以我现在重要的密码一般会从数学书上不重要的位置上摘一句，并且稍作加工，比如说这样的：A linear functional on a closed subspace can be extended to the whole space.嗯一般密码库里是不会有这种东西的。至于怎么记呢？很显然这是Hahn-Banach定理的简单推论，于是你当然早就牢牢地记住啦。其它专业的人在书里面找个比较顺眼但又不是特别有名的句子编一下就好，这样的长密码记忆负担低，可以系统地生成多个密码，破解难度却很大。