Set Password Minimum Age
Ensures PASS_MIN_DAYS in /etc/login.defs is at least 1, blocking immediate repeated password changes.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Enforcing a minimum password lifetime prevents users from rapidly cycling through password changes to defeat password-history/reuse controls. With PASS_MIN_DAYS of at least 1, a user cannot change a password and immediately revert to a favorite one in the same session, preserving the integrity of the reuse policy.
What Pavois checks
Pavois uses the InSpec login_defs resource to read the effective resolved value of PASS_MIN_DAYS, parsing /etc/login.defs the way useradd/chage interpret it (last uncommented setting wins). This is the default for newly created accounts; per-user values in /etc/shadow can differ.
describe login_defs do
its('PASS_MIN_DAYS') { should cmp >= 1 }
endHow to verify it is applied
grep -i '^PASS_MIN_DAYS' /etc/login.defsshould printPASS_MIN_DAYS 1(or more).- Per existing account:
chage -l <user>showsMinimum number of days between password change.
Inspect & investigate
grep -i PASS_MIN_DAYS /etc/login.defsshows the default.chage -l <user>shows each account's effective minimum age./var/log/auth.log(Debian/Ubuntu) or/var/log/secure(RHEL) record password change events via PAM.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set PASS_MIN_DAYS 1 in /etc/login.defs. This governs newly created accounts; use chage --mindays 1 <user> to align existing accounts.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/login.defs |
|---|---|
| key | PASS_MIN_DAYS |
| resource | conf_line |
| sep | space |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk. Caution: a non-zero minimum age means a user who must change their password (e.g. after a reset) cannot change it again until the delay elapses, set the new password correctly the first time. Keep PASS_MIN_DAYS well below PASS_MAX_DAYS so users always have a window to renew before expiry. For helpdesk-forced resets, clear the minimum temporarily with chage --mindays 0 <user>.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.1.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.5.8, CM-6(a), IA-5(1)(d), IA-5(f) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-411025, UBTU-24-400300 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.