I believe it is certainly appropriate to set restrictions on passwords. But it depends on what you are trying to protect!
Depending on what information your site (and its authentication system) is guarding. You might be able to get away with setting restrictions to:
min_length = 6 and never expire. While not requiring any form of special characters at all.
But if the site is going to be holding really sensitive information that you should set much tight restrictions.
The security settings on your site should be commensurate with the importance of the data they are protecting.
That being said, you can go to far. Requiring a password that is 32 characters long and forcing a change every 10 days is going to anger user, encourage them to write the password down or perhaps not even bother using the site (find something else)..
In summary - The last recommendation I remember reading (don't have a link for you) was 12 characters minimum with At least 1 number or special character. Also, consider implementing a system that disables an account for a set length of time (30 minutes, 2 hours, whatever) after x amount of failed logins.
hope this helps..