Set Password Warning Age
Sets PASS_WARN_AGE in /etc/login.defs so users are warned at least 7 days before their password expires.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Warning users in advance of password expiration lets them change it at a convenient time rather than being locked out unexpectedly. Without a warning window, a password can silently expire mid-task, forcing rushed (often weaker) replacements or generating help-desk tickets and lost access.
What Pavois checks
Pavois reads the resolved PASS_WARN_AGE from /etc/login.defs via the InSpec login_defs resource and asserts it is >= 7. This is the default applied to newly created accounts; per-account overrides live in /etc/shadow (field 6). Reading the effective directive avoids relying on documentation or assumptions.
describe login_defs do
its('PASS_WARN_AGE') { should cmp >= 7 }
endHow to verify it is applied
Run grep '^PASS_WARN_AGE' /etc/login.defs. Expected output: PASS_WARN_AGE 7 (or higher). To check an existing account, run chage -l <user> and read the Password expires / warning fields.
Inspect & investigate
Expiration warnings appear at login in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL). Per-account aging is shown by chage -l <user>; the default by grep PASS_WARN_AGE /etc/login.defs.
Remediation
No automated harden plan ships for this rule; apply it manually by setting PASS_WARN_AGE 7 in /etc/login.defs. This affects only newly created accounts, existing accounts keep their /etc/shadow value, which you can update with chage --warndays 7 <user>.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/login.defs |
|---|---|
| key | PASS_WARN_AGE |
| resource | conf_line |
| sep | space |
| value | 7 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This is a low-risk, advisory setting: it never blocks logins and cannot cause lockout. The only consequence of a low or zero value is reduced warning time, leading to surprise expirations. When applying, remember the login.defs value only governs future accounts; run chage on existing users if you need uniform behavior.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.1.3, 8.3.9 | direct | per OS, see the benchmark table | high |
| NIST | 3.5.8, CM-6(a), IA-5(1)(d), IA-5(f) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.3.9 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.