I have two questions about the system-auth file
1) If the /etc/pam.d/system-auth password complexity settings are changed on an existing system, does it invalidate any existing passwords?
2) Is it possible to say that lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 <-- at least three out of the four character groups should be enforced?
Thanks!
edit:
2) is answered here: http://linux.die.net/man/8/pam_passwdqc and http://www.cyberciti.biz/faq/rhel-fedora-centos-linux-password-quality-control/
pam_passwdqc
is better thanpam_cracklib
, easier to configure and easier to understand