Detections
Analytics

5.5.1.2 Ensure minimum days between password changes is configured - login.defs

Information

The PASS_MIN_DAYS parameter in /etc/login.defs allows an administrator to prevent users from changing their password until a minimum number of days have passed since the last time the user changed their password. It is recommended that PASS_MIN_DAYS parameter be set to 1 or more days.

Rationale:

By restricting the frequency of password changes, an administrator can prevent users from repeatedly changing their password in an attempt to circumvent password reuse controls.

Solution

Set the PASS_MIN_DAYS parameter to 1 in /etc/login.defs :

PASS_MIN_DAYS 1

Modify user parameters for all users with a password set to match:

# chage --mindays 1 <user>

Additional Information:

Red Hat Enterprise Linux 7 Security Technical Implementation Guide

Version 3, Release: 4 Benchmark Date: 23 Jul 2021

Vul ID: V-204418

Rule ID: SV-204418r603261_rule

STIG ID: RHEL-07-010230

Severity: CAT II

Vul ID: V-204419

Rule ID: SV-204419r603261_rule

STIG ID: RHEL-07-010240

Severity: CAT II

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1)(d), CCI|CCI-000198, CSCv7|4.4, Rule-ID|SV-204418r603261_rule, Rule-ID|SV-204419r603261_rule, STIG-ID|RHEL-07-010230

Plugin: Unix

Control ID: 2b694976f5a780f154c5be10eb769318f247e9ac0f0544fb2a243c336d756b5b