/etc/pam.d/common-password we have a line such as:
password [success=1 default=ignore] pam_unix.so sha512 rounds=200000
Meaning, whenever anyone sets their password, hash it with 200,000 rounds of SHA-512. This inherently slow hashing protects against dictionary and brute-force attacks by limiting the speed at which passwords can be tested.
For some accounts we might want to protect the password better, at the
expense of slower hashing. Say, 500,000 rounds for an admin account, and
root. But I have not been able to find any way to specify
such per-user or per-group policies in PAM. Can this be done?