Detections
Analytics

5.6.1.3 Ensure password expiration warning days is 7 or more - login.defs

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The PASS_WARN_AGE parameter in /etc/login.defs allows an administrator to notify users that their password will expire in a defined number of days. It is recommended that the PASS_WARN_AGE parameter be set to 7 or more days.

Rationale:

Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may choose a simple password or write it down where it may be discovered.

Solution

Set the PASS_WARN_AGE parameter to 7 in /etc/login.defs :

PASS_WARN_AGE 7

Modify user parameters for all users with a password set to match:

# chage --warndays 7 <user>

Additional Information:

You can also check this setting in /etc/shadow directly. The 6th field should be 7 or more for all users with a password.

See Also

https://workbench.cisecurity.org/files/3746

Item Details

References: CSCv7|4.4

Plugin: Unix

Control ID: 21d4bae620a201d9945ee074d561523a6745719bfdd3ad67caad726d98d92a77