login.defs是设置用户帐号限制的文件，在这里我们可配置密码的最大过期天数，密码的最大长度约束等内容。该文件里的配置对root用户无效。如果/etc/shadow文件里有相同的选项，则以/etc/shadow里的设置为准，也就是说/etc/shadow的配置优先级高于/etc/login.defs

 

[root@w ~]# cat /etc/login.defs

#

# Please note that the parameters in this configuration file control the

# behavior of the tools from the shadow-utils component. None of these

# tools uses the PAM mechanism, and the utilities that use PAM (such as the

# passwd command) should therefore be configured elsewhere. Refer to

# /etc/pam.d/system-auth for more information.

#


# *REQUIRED*

#   Directory where mailboxes reside, _or_ name of file, relative to the

#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.

#   QMAIL_DIR is for Qmail

#

#QMAIL_DIR      Maildir

MAIL_DIR        /var/spool/mail        注：创建用户时，要在目录/var/spool/mail中创建一个用户mail文件；

#MAIL_FILE      .mail


# Password aging controls:

#

#       PASS_MAX_DAYS   Maximum number of days a password may be used.

#       PASS_MIN_DAYS   Minimum number of days allowed between password changes.

#       PASS_MIN_LEN    Minimum acceptable password length.

#       PASS_WARN_AGE   Number of days warning given before a password expires.

#

PASS_MAX_DAYS   99999                  注：一个密码最长可以使用的天数；

PASS_MIN_DAYS   0                      注：更换密码的最小天数；

PASS_MIN_LEN    5                      注：密码的最小长度；

PASS_WARN_AGE   7                      注：密码失效前提前多少天数开始警告；


#

# Min/max values for automatic uid selection in useradd

#

UID_MIN                   500          注：最小UID为500，也就是说添加用户时，UID是从500开始的，就是这个地方控制

UID_MAX                 60000          注：最大UID为60000；


#

# Min/max values for automatic gid selection in groupadd

#

GID_MIN                   500          注：GID依然是从500开始；同上面用户的情况；

GID_MAX                 60000


#

# If defined, this command is run when removing a user.

# It should remove any at/cron/print jobs etc. owned by

# the user to be removed (passed as the first argument).

#

#USERDEL_CMD    /usr/sbin/userdel_local


#

# If useradd should create home directories for users by default

# On RH systems, we do. This option is overridden with the -m flag on

# useradd command line.

#

CREATE_HOME     yes                    注：是否创建用户家目录，默认要求创建，可用-m参数来控制


# The permission mask is initialized to this value. If not specified, 

# the permission mask will be initialized to 022.

UMASK           077


# This enables userdel to remove user groups if no members exist.

#

USERGROUPS_ENAB yes                   注：删除用户同时删除用户组


# Use SHA512 to encrypt password.

ENCRYPT_METHOD SHA512                 注：MD5密码加密


学习自：

老男孩