配置强管理员密码策略
只是想知道除了“最短密码期限”、“密码必须满足复杂性要求”等通用策略之外是否还有更多密码策略。我想为管理员创建更强大的密码策略。有没有办法增加密码要求的复杂性？
另一件事，有没有办法阻止用户做这样的事情：
旧密码：password1（过期...） 新密码：password2（过期...） 等等。
我们发现很多用户只是在密码末尾添加一个新数字。
预先感谢，
马特
Just wondering if there are more password policies beyond the generic ones such as "minimum password age", "password must meet complexity requirements", etc. I would like to create stronger password policies for the administrators. Is there a way to add more complexity to the password requirements?
Another thing, is there a way to prevent users from doing stuff like this:
old password: password1 (expires...)
new password: password2 (expires...)
etc.
We find that a lot of users are just adding a new number to the end of their password.
Thanks in advance,
Matt
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
这是密码复杂性的一个众所周知的问题，尤其是老化要求 - 它们通常会降低安全性，因为人们会在记不住密码时写下密码。如果您的用户这样做，则很好地表明您的密码过期得太快了。
另请参阅：密码复杂性策略 - 有证据吗？
This is a well known problem with password complexity and, especially, ageing requirements - they often reduce security as people will write down passwords as they can't remember them. If your users are doing this then it's a good indication that you are expiring passwords too quickly.
See also: Password complexity strategies - any evidence for them?
如今，密码强度和可用性常常不一致。如果您是具有前瞻性思维的组织的一员，我发现的最佳技术是鼓励用户使用既能解决您的问题又能解决他们的问题的应用程序，例如 密码管理器。 KeePass 和 密码保险箱就是两个这样的应用程序，但还有许多其他应用程序。新政策如下：
这种方法有几个优点/缺点；但请相信我，当用户不必处理当今密码所需的所有不友好的废话时，他们会更高兴，并且他们实际上可能会停止缩短您的策略。
Password strength and usability are often at odds these days. If you're part of a forward thinking organization, the best technique that I've found is to encourage users to make use of applications that both solve your problem and theirs, such as Password Managers. KeePass and Password Safe are two such applications, but there are many others. Here is the new policy:
There are several pros / cons to this approach; but believe me, users are happier when they don't have to deal with all of the unfriendly nonsense required by passwords these days AND they might actually stop short cutting your policies.
最短和最长密码期限、密码历史记录（与最短期限一致）、一次性密码本、使用令牌或智能卡等加密硬件的基于加密的方法，......许多安全选项。
如果您只是想让密码本身更复杂，...只需决定您的目标是什么（例如，想要避免出现在彩虹表中，想要进行攻击至少需要 X 小时/天/周/月）并选择基于此您的复杂性要求。
如果您规定密码必须包含字母、数字、符号，至少 16 个字符，并且其中不包含任何单词（包括 leeted 单词），那么您可能相当安全，除非您的管理员已经编写了密码下来并将其放在键盘下方。
这个很容易。通常将最短密码期限与以明文形式保留 N 个历史密码（但绝对不是当前密码）相结合，以防止人们快速重复使用密码。只需确定新密码的差异程度，然后检查每个新密码的编辑距离历史密码。
Minimum and maximum password age, password history (goes with the minimum age), a one-time pad, a crypto-based approach using crypto hardware like tokens or smartcards, .... lots of security options.
If you just want to make the password itself more complex, ... just decide what your goals are (e.g. want to avoid being in rainbow tables, want to make an attack take at least X hours/days/weeks/months) and chose your complexity requirements based on that.
If you say that the password must contain letters, numbers, symbols, be at least 16 characters, and have no words in it (including leeted words), you're probably reasonably safe, except for the fact that your admins have written the password down and put it under their keyboard.
This one is easy. It is common to combine a minimum password age with keeping N historical (but definitely NOT the current password) passwords in cleartext to prevent people from re-using the passwords quickly. Simply decide how different new passwords must be, and check the edit distance of the new password from each historic password.
正如 Sponsz 上校指出的那样，一些研究数据表明这些政策通常会让事情变得更糟。
我建议尝试一些免费工具，例如无状态密码生成器（例如 Getpass），因为它们生成高度复杂的（对于现代标准）默认密码。此外，与云密码管理器不同，它们不存储密码或任何其他客户端数据。它们是免费且开源的。
As Colonel Sponsz pointed out, there is some research data suggesting that these policies usually make matters worse.
I would suggest experimenting with some free tools like stateless password generators (e.g. Getpass) as they generate highly complex (for modern standards) passwords by default. Also, unlike cloud password managers, they don't store passwords or any other client data. They are free and open source.