Set login.defs defaults for SUSE Linux.

Index: etc/login.defs
===================================================================
--- etc/login.defs.orig
+++ etc/login.defs
@@ -3,6 +3,9 @@
 # Some variables are used by login(1), su(1) and runuser(1) from util-linux
 # package as well pam pam_unix(8) from pam package.
 #
+# For more, see login.defs(5). Please note that SUSE supports only variables
+# listed here! Not listed variables from login.defs(5) have no effect.
+#
 
 #
 # Delay in seconds before being allowed another attempt after a login failure
@@ -62,8 +65,7 @@ CONSOLE		/etc/securetty
 # If defined, ":" delimited list of "message of the day" files to
 # be displayed upon login.
 #
-MOTD_FILE	/etc/motd
-#MOTD_FILE	/etc/motd:/usr/lib/news/news-motd
+#MOTD_FILE	/etc/motd:/usr/share/misc/motd
 
 #
 # If set to "yes", login stops display content specified by MOTD_FILE after
@@ -83,8 +85,8 @@ MOTD_FILE	/etc/motd
 # user's name or shell are found in the file.  If not a full pathname, then
 # hushed mode will be enabled if the file exists in the user's home directory.
 #
-HUSHLOGIN_FILE	.hushlogin
-#HUSHLOGIN_FILE	/etc/hushlogins
+#HUSHLOGIN_FILE	.hushlogin
+HUSHLOGIN_FILE	/etc/hushlogins
 
 # If this variable is set to "yes", hostname will be suppressed in the
 # login: prompt.
@@ -103,9 +105,9 @@ HUSHLOGIN_FILE	.hushlogin
 # ENV_SUPATH is an ENV_ROOTPATH override for su and runuser
 # (and falback for login).
 #
-ENV_PATH	/bin:/usr/bin
-ENV_ROOTPATH	/sbin:/bin:/usr/sbin:/usr/bin
-#ENV_SUPATH	/sbin:/bin:/usr/sbin:/usr/bin
+ENV_PATH	/usr/local/bin:/bin:/usr/bin
+ENV_ROOTPATH	/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+#ENV_SUPATH	/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
 # If this variable is set to "yes" (default is "no"), su will always set
 # path. every su call will overwrite the PATH variable.
@@ -115,7 +117,7 @@ ENV_ROOTPATH	/sbin:/bin:/usr/sbin:/usr/b
 # The recommended value is "yes". The default "no" behavior could have
 # a security implication in applications that use commands without path.
 #
-ALWAYS_SET_PATH	no
+ALWAYS_SET_PATH	yes
 
 #
 # Terminal permissions
@@ -129,7 +131,7 @@ ALWAYS_SET_PATH	no
 # set TTYPERM to either 622 or 600.
 #
 TTYGROUP	tty
-TTYPERM		0600
+TTYPERM		0620
 
 # Default initial "umask" value used by login(1) on non-PAM enabled systems.
 # Default "umask" value for pam_umask(8) on PAM enabled systems.
@@ -167,8 +169,8 @@ PASS_WARN_AGE	7
 UID_MIN			 1000
 UID_MAX			60000
 # System accounts
-SYS_UID_MIN		  101
-SYS_UID_MAX		  999
+SYS_UID_MIN		  100
+SYS_UID_MAX		  499
 # Extra per user uids
 SUB_UID_MIN		   100000
 SUB_UID_MAX		600100000
@@ -185,8 +187,8 @@ SUB_UID_COUNT		    65536
 GID_MIN			 1000
 GID_MAX			60000
 # System accounts
-SYS_GID_MIN		  101
-SYS_GID_MAX		  999
+SYS_GID_MIN		  100
+SYS_GID_MAX		  499
 # Extra per user group ids
 SUB_GID_MIN		   100000
 SUB_GID_MAX		600100000
@@ -195,7 +197,7 @@ SUB_GID_COUNT		    65536
 #
 # Max number of login(1) retries if password is bad
 #
-LOGIN_RETRIES		5
+LOGIN_RETRIES		3
 
 #
 # Max time in seconds for login(1)
@@ -211,18 +213,9 @@ LOGIN_TIMEOUT		60
 CHFN_RESTRICT		rwh
 
 #
-# If set to "yes", new passwords will be encrypted using the MD5-based
-# algorithm compatible with the one used by recent releases of FreeBSD.
-# It supports passwords of unlimited length and longer salt strings.
-# Set to "no" if you need to copy encrypted passwords to other systems
-# which don't understand the new algorithm.  Default is "no".
-#
-# Note: If you use PAM, it is recommended to use a value consistent with
-# the PAM modules configuration.
-#
-# This variable is deprecated. You should use ENCRYPT_METHOD instead.
+# This variable is deprecated. Use ENCRYPT_METHOD instead!
 #
-#MD5_CRYPT_ENAB	no
+#MD5_CRYPT_ENAB	DO_NOT_USE
 
 #
 # If set to MD5, MD5-based algorithm will be used for encrypting password
@@ -235,7 +228,7 @@ CHFN_RESTRICT		rwh
 # Note: If you use PAM, it is recommended to use a value consistent with
 # the PAM modules configuration.
 #
-#ENCRYPT_METHOD DES
+ENCRYPT_METHOD SHA512
 
 #
 # Only works if ENCRYPT_METHOD is set to SHA256 or SHA512.
@@ -311,7 +304,7 @@ USERDEL_POSTCMD         /usr/sbin/userde
 #
 # This also enables userdel(8) to remove user groups if no members exist.
 #
-USERGROUPS_ENAB yes
+USERGROUPS_ENAB no
 
 #
 # If set to a non-zero number, the shadow utilities will make sure that
@@ -330,13 +323,13 @@ USERGROUPS_ENAB yes
 # This option is overridden with the -M or -m flags on the useradd(8)
 # command-line.
 #
-#CREATE_HOME     yes
+CREATE_HOME     no
 
 #
 # Force use shadow, even if shadow passwd & shadow group files are
 # missing.
 #
-#FORCE_SHADOW    yes
+FORCE_SHADOW    no
 
 #
 # User/group names must match the following regex expression.