Where/how do I set the retention on system logs to a minimum of 180 days? Further, where do you set password failure enforcement policies?

Hello,
I have more of SLES background but i'm sure they are pretty much the same. Generally retention periods on your log files will be set in a few configuration files. Most likely your system will be using 'log-rotate' of which the files can be found generally within the directory '/etc/logrotate.d/'

Within the files in that directory you'll want to make changes to the 'rotate' parameter to set the life of the number of log files.

This will probably help very well if your using logrotate.
http://www.debian-administration.org/articles/117

For password policies maybe this will do the trick?
http://www.planetmy.com/blog/set-a-g...licy-on-linux/

Hope it helps.