mediumaccess-controlverified ✓rollback-safe
Ensure password expiration warning days is configured
password-warn-age · RHEL ≥ 8 · 1 impl
Description
The PASS_WARN_AGE setting in /etc/login.defs must be properly configured.
Rationale
Improper PASS_WARN_AGE configuration could weaken system security controls.
Check → Remediate
Checkconfig_value
- delimiter:
- path:
- /etc/login.defs
- key:
- PASS_WARN_AGE
- expected:
- {{ login_defs_pass_warn_age }}
- comparator:
- >=
Remediateconfig_set
- path:
- /etc/login.defs
- key:
- PASS_WARN_AGE
- value:
- {{ login_defs_pass_warn_age }}
- separator:
Framework references
CIS
rhel9 5.4.1.3rhel8 5.4.1.3rhel10 5.4.1.3
NIST 800-53
IA-5IA-5(1)(d)
Live verification
rhel10:checkrhel8:checkrhel9:check
#password#login-defs#aging