目录

1. 作用
2. 文件内容
3. 分析

作用

/etc/login.defs 是设置用户帐号限制的文件。该文件里的配置对root用户无效。/etc/login.defs 文件用于在Linux创建用户时，对用户的一些基本属性做默认设置，例如指定用户 UID 和 GID 的范围，用户的过期时间，密码的最大长度，等等。

需要注意的是，该文件的用户默认配置对 root 用户无效。并且，当此文件中的配置与 /etc/passwd 和 /etc/shadow 文件中的用户信息有冲突时，系统会以/etc/passwd 和 /etc/shadow 为准。

如果/etc/shadow文件里有相同的选项，则以/etc/shadow里的设置为准，也就是说/etc/shadow的配置优先级高于/etc/login.defs

文件内容

+ cat /etc/login.defs
#
# Please note that the parameters in this configuration file control the
# behavior of the tools from the shadow-utils component. None of these
# tools uses the PAM mechanism, and the utilities that use PAM (such as the
# passwd command) should therefore be configured elsewhere. Refer to
# /etc/pam.d/system-auth for more information.
## *REQUIRED*
#   Directory where mailboxes reside, _or_ name of file, relative to the
#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
#   QMAIL_DIR is for Qmail
#
#QMAIL_DIR      Maildir
MAIL_DIR        /var/spool/mail
#MAIL_FILE      .mail# Password aging controls:
#
#       PASS_MAX_DAYS   Maximum number of days a password may be used.
#       PASS_MIN_DAYS   Minimum number of days allowed between password changes.
#       PASS_MIN_LEN    Minimum acceptable password length.
#       PASS_WARN_AGE   Number of days warning given before a password expires.
#
PASS_MAX_DAYS   99999
PASS_MIN_DAYS   0
PASS_MIN_LEN    5
PASS_WARN_AGE   7#
# Min/max values for automatic uid selection in useradd
#
UID_MIN                  1000
UID_MAX                 60000
# System accounts
SYS_UID_MIN               201
SYS_UID_MAX               999#
# Min/max values for automatic gid selection in groupadd
#
GID_MIN                  1000
GID_MAX                 60000
# System accounts
SYS_GID_MIN               201
SYS_GID_MAX               999#
# If defined, this command is run when removing a user.
# It should remove any at/cron/print jobs etc. owned by
# the user to be removed (passed as the first argument).
#
#USERDEL_CMD    /usr/sbin/userdel_local#
# If useradd should create home directories for users by default
# On RH systems, we do. This option is overridden with the -m flag on
# useradd command line.
#
CREATE_HOME     yes# The permission mask is initialized to this value. If not specified,
# the permission mask will be initialized to 022.
UMASK           077# This enables userdel to remove user groups if no members exist.
#
USERGROUPS_ENAB yes# Use SHA512 to encrypt password.
ENCRYPT_METHOD SHA512

分析

• MAIL_DIR
• PASS_MAX_DAYS
  /etc/shadow第五栏位字段
• PASS_MIN_DAYS
  /etc/shadow第四栏位字段
• PASS_MIN_LEN
  设置密码时最短字符长度
• PASS_WARN_AGE
  /etc/shadow第六栏位字段
• UID_MIN
• UID_MAX
• SYS_UID_MIN
• SYS_UID_MAX
• GID_MIN
• GID_MAX
• SYS_GID_MIN
• SYS_GIN_MAX
• CREATE_HOME
  在不加-m or -M时，是否主动建立使用者家目录；
• UMASK
• USERGROUPS_ENAB
  使用【userdel】时是否会删除初始用户组(当没有其它账号属于该用户组时)；
• ENCRYPT_METHOD
  密码的加密机制；