THat is correct. You will also need to run through /etc/shadow and
make sure that any account with passwords has the correct values in
them also.
What do you exactly mean by running through /etc/shadow.
Password history you will need to use the pam_passwdqc moduel in pam.
Most security policies will ask for a minimum length of 7 characters
(though 8 is preferred), and a change time of 90 days.
As I mentioned, I changed /etc/pam.d/system-auth file and /etc/login.defs file(Made minimum password length as 9), but it is not reflecting when the user issues passwd command.
I will do some home work here and get back to you on Monday.
--
Stephen J Smoogen.
CSIRT/Linux System Administrator
