Protect Accounts by Restricting Password-Based Login

grep 'inactive\|pam_unix' /etc/pam.d/password-auth | grep -w auth

auth required pam_lastlog.so inactive=35
auth sufficient pam_unix.so

grep 'inactive\|pam_unix' /etc/pam.d/password-auth | grep -w auth

auth required pam_lastlog.so inactive=35
auth sufficient pam_unix.so

INACTIVE=

$ sudo chage -E YYYY-MM-DD ACCOUNT_NAME

$ sudo chage -E YYYY-MM-DD USER

$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d

PASS_MAX_DAYS 

PASS_MIN_DAYS 

PASS_MIN_LEN 

$ sudo chage -M  USER

$ sudo chage -m 1 USER

PASS_WARN_AGE 

$ sudo cut -d: -f2 /etc/shadow
$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/

password sufficient pam_unix.so ...existing_options... rounds=

password sufficient pam_unix.so ...existing_options... rounds=

$ sudo awk -F: '!$2 {print $1}' /etc/shadow

$ sudo passwd [username]

$ sudo passwd -l [username]

$ sudo echo > /etc/securetty

$ sudo usermod -L account

$ sudo usermod -s /sbin/nologin account

ttyS0
ttyS1

~/.profile

~/.bashrc

vc/1
vc/2
vc/3
vc/4

auth required pam_wheel.so use_uid