Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Enforce a Linux VPS password policy through PAM, not through one universal setting. Configure password strength with pam_pwquality, reuse history with the distribution’s supported history module, account aging with chage, and failed-login lockout with pam_faillock. The exact include file and management tool depend on whether the VPS runs Ubuntu/Debian or a RHEL-family distribution.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Keep an existing privileged session and an out-of-band recovery path open while changing PAM. A syntax or ordering mistake can prevent every new login, including yours.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What a Linux VPS password policy actually controls
A password policy is a group of controls applied at different points in authentication and account management. Treating it as a single “minimum characters” setting leaves important gaps.
| Control | What it does | Typical Linux component |
|---|---|---|
| Password strength | Checks length, character classes, dictionary words, usernames, similarity, repeated characters, and sequences. | pam_pwquality |
| Password history | Prevents reusing a configured number of previous passwords. | pam_pwhistory on RHEL-family systems |
| Password aging | Sets minimum and maximum password age, inactivity after expiry, and an expiration date for each account. | chage |
| Failed-login lockout | Counts consecutive authentication failures and temporarily locks an account. | pam_faillock and faillock |
PAM (Pluggable Authentication Modules) is the enforcement layer for local Unix password changes and logins. PAM reads a stack of modules; the active stack is assembled differently on Ubuntu/Debian and RHEL-family systems. Always identify the operating system and release before editing a file.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prepare a safe change window
- Open a second SSH session with a known-working administrator account and leave the first session untouched.
- Confirm access to the VPS provider’s serial, web, or recovery console, or another already-authorized administrator.
- Record the current PAM files and settings so you can restore them. For example, copy a file before editing rather than overwriting it in place.
- Create a non-privileged test account and test the policy there before changing an administrator or service account.
- Make one logical change at a time. Test password changes and logins after each change.
Do not test lockout rules against your only sudo-capable account. A lockout can be intentional while you are testing, but it must not remove your only recovery route.
Identify the distribution and active authentication stack
Run this command to identify the operating system:
cat /etc/os-releaseOn Ubuntu and Debian, the common local password stack is normally included from /etc/pam.d/common-password. Ubuntu’s documented default for that stack is a six-character minimum. On RHEL 8, 9, and 10, authentication profiles are commonly managed with the vendor-supported authentication-management tooling rather than by manually rewriting generated PAM files. The profile ultimately invokes modules such as pam_pwquality, pam_pwhistory, and pam_faillock.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInspect the files and profile before changing anything. A module may already be present, and adding a second conflicting line can produce unexpected results.
Configure password strength on Ubuntu or Debian
Install the quality module
Install the package if it is not already available:
sudo apt update
sudo apt install libpam-pwqualityThe package supplies pam_pwquality.so. Some images already include it; installing it again simply confirms that the module is available.
Choose where the rules live
Ubuntu supports putting rules in /etc/security/pwquality.conf or as arguments on the pam_pwquality.so line in the active PAM password stack. A setting supplied directly on the module line overrides the corresponding value in pwquality.conf. That precedence matters: changing the configuration file will not change an option that is hard-coded on the PAM line.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Edit the central configuration file:
sudo editor /etc/security/pwquality.confThen inspect the password stack:
sudo editor /etc/pam.d/common-passwordUbuntu’s documentation demonstrates adding minlen=8 to the pam_unix.so line. If you use pam_pwquality, make sure its line is actually reached during a password change and that its control flag does not allow a later module to bypass the result. Do not blindly paste a complete PAM line from another release; module order and control flags are significant.
Understand the quality options
| Option or family | Purpose | Policy question |
|---|---|---|
minlen |
Sets the minimum effective password length. | What minimum length is appropriate for your users and threat model? |
dcredit, ucredit, lcredit, ocredit |
Require or reward digits, uppercase, lowercase, and other characters, depending on the value. | Do you need character classes, or would longer passphrases be easier to use? |
dictcheck |
Checks passwords against dictionary words. | Is the configured dictionary available and suitable for the server’s language? |
usercheck |
Rejects passwords containing the account name or related forms. | Would a username-based password be an obvious target? |
usercheck and similarity controls |
Can reject passwords too similar to the old password or user information, depending on the module version and option. | How much incremental change should be rejected? |
maxrepeat and maxsequence |
Limit repeated characters and monotonic sequences. | Should values such as repeated letters or ascending digits be blocked? |
Use values you can explain and support. An elaborate character-class rule can encourage predictable substitutions; a length rule, dictionary check, username check, and reuse prevention may provide a more useful policy. Test the exact behavior with the same password-change path your users will use.
Verify the effective Ubuntu settings
Check the PAM line and configuration rather than assuming the file you edited is active:
grep -nE 'pam_pwquality|pam_unix' /etc/pam.d/common-password
grep -nEv '^[[:space:]]*(#|$)' /etc/security/pwquality.confThe second command prints non-comment, non-blank settings. Keep in mind that arguments on the PAM line take precedence over values in the configuration file.
Free tools Windows power users keep installed
One-click scans. No signup required.
Configure password strength and history on RHEL-family VPSs
Use the supported authentication-management method
Red Hat documents pam_pwquality for complexity and pam_pwhistory for password reuse history on RHEL 8, 9, and 10. RHEL systems commonly use an authentication profile manager to generate and maintain PAM files. Determine the active profile and follow the instructions for that release instead of editing generated files that may be overwritten.
After applying a profile change, inspect the resulting PAM stack. Confirm that the password stack invokes pam_pwquality before accepting a new password and that pam_pwhistory is present with the intended history count. The exact profile and file layout can vary by release and by whether the image uses a custom authentication profile.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Set the history count deliberately
Password history is separate from complexity. A password can satisfy every strength rule and still be a reuse of an old password unless a history module rejects it. Set a finite history count that matches your rotation policy; document the value so administrators know how many prior passwords are retained by the module. Do not assume that a strength setting automatically enables history.
When changing RHEL authentication configuration, verify the generated files and test with a non-privileged account. Keep the second administrator session open until a password change and a fresh SSH login have both succeeded.
Recommended Free Tools
Set password aging per account with chage
Password aging is stored per account, not as one global timer. Inspect an account before changing it:
sudo chage -l USERNAMEThe report shows the last password change, minimum days between changes, maximum lifetime, warning period, account expiration, and inactivity status. Replace USERNAME with the actual local account name.
Common aging operations
| Command pattern | Effect |
|---|---|
sudo chage -m DAYS USERNAME |
Sets the minimum number of days before the password may be changed again. |
sudo chage -M DAYS USERNAME |
Sets the maximum password lifetime in days. |
sudo chage -I DAYS USERNAME |
Sets the number of inactive days after a password expires before the account is disabled. |
sudo chage -E YYYY-MM-DD USERNAME |
Sets an account expiration date. |
sudo chage -d 0 USERNAME |
Marks the password as needing a change at the next successful login. |
Apply a change, then inspect the result:
sudo chage -M 180 USERNAME
sudo chage -W 14 USERNAME
sudo chage -l USERNAMEThe values above are an example of a 180-day maximum and a 14-day warning; they are not universal recommendations. Choose an interval that fits your operational risk, administrator workload, and use of stronger authentication. Never set an aggressive maximum on an unattended service account without understanding how that account authenticates and how its credential will be rotated.
To force an administrator to choose a new password without changing the policy for every account, use chage -d 0 on that account. Verify that the account can complete an interactive password change before closing your recovery session.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Lock accounts after failed SSH or console logins
How pam_faillock works
pam_faillock keeps failed-authentication records per user. Once consecutive failures exceed the configured threshold within the configured interval, the account is treated as locked. The faillock command displays those records and can reset them.
The upstream Linux-PAM configuration reference lists these defaults:
| Setting | Documented default | Meaning |
|---|---|---|
deny |
3 | Lock after more than three consecutive failures when the other conditions are met. |
fail_interval |
900 seconds (15 minutes) | Time window in which failures are counted. |
unlock_time |
600 seconds (10 minutes) | How long a normal lock remains before automatic release. |
These are upstream defaults, not a guarantee that every VPS image uses them. Distribution profiles, existing configuration, and authentication paths can change the effective behavior.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure the lockout policy
On systems using the standard configuration file, settings are placed in /etc/security/faillock.conf and the PAM stack invokes pam_faillock.so. RHEL documentation also requires using the release’s supported authentication-management method so the pre-authentication and post-authentication calls are inserted consistently. Inspect the resulting stack after any change.
Choose the threshold and duration together. A low threshold reduces online guessing but increases the chance that a typo or deliberate nuisance attempt locks a user. A long lockout frustrates attackers but can also deny legitimate access during an incident.
Decide how root is treated
Root handling is explicit. The even_deny_root option makes root subject to the failure threshold; root_unlock_time controls a separate automatic unlock period for root when that behavior is enabled. Locking root can improve resistance to guessing, but it creates a serious recovery requirement. Many operators instead prohibit direct root SSH access and require a named administrator account with sudo, reducing the need to test lockout against root at all.
Inspect and reset records
sudo faillock --user USERNAME
sudo faillock --user USERNAME --resetUse the first command to see whether failures are recorded for the expected account. Use --reset only after confirming that the lockout is understood and the account should be released. If your only administrator is locked, use the VPS provider console or another authorized administrator rather than repeatedly attempting SSH.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsTest the complete policy without losing access
- Create a temporary test account with no administrative privileges.
- From the server, change its password through the same mechanism users will use. Confirm that a deliberately weak password is rejected and a compliant password succeeds.
- Attempt a password reuse test if history is configured. Use a disposable test password, not a real credential.
- Run
sudo chage -l TESTUSERand verify that the aging values match the intended policy. - From a separate client, make controlled failed-login attempts and stop before the account reaches the threshold unless you are specifically testing lockout.
- If testing lockout, record the exact number of attempts, wait for the configured interval, and verify the account’s state with
faillock. - Reset the test record with
sudo faillock --user TESTUSER --reset, then confirm a correct password works again. - Only after these checks succeed, apply the policy to administrative accounts and perform one fresh login test while the recovery session remains open.
Keep SSH daemon settings and PAM settings conceptually separate. A password policy controls how local passwords are created, aged, and challenged; SSH may independently disable password authentication, restrict users, or require keys. Changing one does not automatically change the other.
Troubleshoot common failures
“The new minimum length has no effect”
- Confirm that
libpam-pwqualityis installed. - Check that the active PAM password stack calls
pam_pwquality.so. - Look for a module-line argument overriding
/etc/security/pwquality.conf. - Test an actual password change; editing a file does not retroactively alter existing passwords.
“A compliant password is rejected”
- Inspect dictionary, username, similarity, repeated-character, sequence, and character-class rules, not just
minlen. - Check the module’s control flow and ordering. Another stack entry may impose an additional requirement.
- Review system authentication logs for the module’s reason, while avoiding the publication or storage of test passwords.
“The lockout never triggers”
- Verify that the login path actually invokes
pam_faillock; a different authentication service or federated identity path may bypass local PAM. - Check the effective threshold and interval rather than assuming the upstream defaults.
- Inspect records with
faillock --user USERNAMEafter a controlled test.
“An administrator is locked out”
- Stop repeated attempts so the failure count does not continue.
- Use an already-authorized administrator or the VPS provider’s recovery console.
- Inspect the record, reset it if the lockout is expected, and document why it occurred.
- Do not disable all lockout protection as a first response; fix the access path and retain a tested recovery method.
“Changes disappear after a reboot or update”
On RHEL-family systems, generated PAM files can be replaced when the authentication profile changes. Make the change through the supported profile-management method and then verify the generated stack. On any distribution, keep a documented copy of the intended policy and recheck it after major upgrades.
Local passwords versus federated identities
Local PAM rules apply to local Unix password changes and authentication. They do not automatically govern every external identity path. Ubuntu’s authd documentation specifically notes that libpwquality settings do not apply to Entra ID passwords authenticated through the Entra flow; that password policy must be enforced by the identity provider’s tenant.
Before promising users that a VPS policy covers everyone who can log in, inventory the authentication sources: local accounts, SSH keys, centralized directories, cloud identity integrations, and service-specific authentication. Apply complexity, history, aging, and lockout controls in the system that actually accepts each credential.
A practical policy design checklist
- Distribution: Record the OS family and release, the active PAM include or profile, and the package versions.
- Strength: Set a minimum length and enable only the complexity, dictionary, username, repetition, and sequence checks you can support and explain.
- History: Configure a reuse count separately; do not assume complexity prevents reuse.
- Aging: Set and audit per-account values with
chage. Exempt or separately manage service accounts only after documenting their credential-rotation method. - Lockout: Choose the failure threshold, counting interval, unlock duration, and root treatment as one decision.
- Recovery: Test a console or second-administrator path before enabling lockout on privileged accounts.
- Verification: Test password change, reuse rejection, aging display, failed-login counting, reset, and a clean login from a separate client.
- Scope: Identify federated and non-PAM authentication paths and enforce their policies at the identity provider or service that owns them.
A strong policy is useful only when the active PAM stack enforces it, administrators can recover from lockouts, and every authentication path is covered by the system that controls its credentials.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
