Set Password Maximum Age
Ensures PASS_MAX_DAYS in /etc/login.defs is 365 or fewer, forcing periodic password changes for new accounts.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Any password can eventually be cracked, so passwords must be changed periodically. If the system never forces a password change, a compromised credential stays valid indefinitely. Setting PASS_MAX_DAYS to 365 or fewer bounds how long a leaked or guessed password remains usable. (Setting it too low is counterproductive, encouraging users to write passwords down.)
What Pavois checks
Pavois uses the InSpec login_defs resource to read the effective resolved value of PASS_MAX_DAYS, parsing /etc/login.defs the way useradd/chage interpret it (last uncommented setting wins). This is the default applied to newly created accounts; per-user values in /etc/shadow may differ and are governed separately.
describe login_defs do
its('PASS_MAX_DAYS') { should cmp <= 365 }
endHow to verify it is applied
grep -i '^PASS_MAX_DAYS' /etc/login.defsshould printPASS_MAX_DAYS 365(or less).- Per existing account:
chage -l <user>showsMaximum number of days between password change.
Inspect & investigate
grep -i PASS_MAX_DAYS /etc/login.defsshows the default.chage -l <user>shows each account's effective maximum age./var/log/auth.log(Debian/Ubuntu) or/var/log/secure(RHEL) record password-expiry and change events via PAM.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set PASS_MAX_DAYS 365 (or less) in /etc/login.defs. This only governs newly created accounts; apply chage --maxdays 365 <user> to bring existing accounts into line.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/login.defs |
|---|---|
| key | PASS_MAX_DAYS |
| resource | conf_line |
| sep | space |
| value | 365 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Caution: existing accounts are not changed by editing login.defs alone, and applying chage to all users can suddenly expire passwords if lastchange predates the new window, service/automation accounts can lock out. Exclude or set PASS_MAX_DAYS -1 for non-interactive system accounts, and prefer key-based auth for them. Modern guidance (NIST SP 800-63B) discourages forced rotation absent evidence of compromise; align with your policy.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.1.1, 8.3.9 | direct | per OS, see the benchmark table | high |
| NIST | 3.5.6, CM-6(a), IA-5(1)(d), IA-5(f) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.3.9 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-411030, UBTU-24-400310 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.