<Group id="password_expiration">
<title>Set Password Expiration Parameters</title>
<description>The file <tt>/etc/login.defs</tt> controls several
password-related settings. Programs such as <tt>passwd</tt>,
<tt>su</tt>, and
<tt>login</tt> consult <tt>/etc/login.defs</tt> to determine
behavior with regard to password aging, expiration warnings,
and length. See the man page <tt>login.defs(5)</tt> for more information.
<br/><br/>
Users should be forced to change their passwords, in order to
decrease the utility of compromised passwords. However, the need to
change passwords often should be balanced against the risk that
users will reuse or write down passwords if forced to change them
too often. Forcing password changes every 90-360 days, depending on
the environment, is recommended. Set the appropriate value as
<tt>PASS_MAX_DAYS</tt> and apply it to existing accounts with the
<tt>-M</tt> flag.
<br /><br />
The <tt>PASS_MIN_DAYS</tt> (<tt>-m</tt>) setting prevents password
changes for 7 days after the first change, to discourage password
cycling. If you use this setting, train users to contact an administrator
for an emergency password change in case a new password becomes
compromised. The <tt>PASS_WARN_AGE</tt> (<tt>-W</tt>) setting gives
users 7 days of warnings at login time that their passwords are about to expire.
<br /><br />
For example, for each existing human user <i>USER</i>, expiration parameters
could be adjusted to a 180 day maximum password age, 7 day minimum password
age, and 7 day warning period with the following command:
<pre>$ sudo chage -M 180 -m 7 -W 7 USER</pre>
</description>

<Value id="var_accounts_password_minlen_login_defs" type="number" >
<title>minimum password length</title>
<description>Minimum number of characters in password</description>
<warning category="general">This will only check new passwords</warning>
<value selector="">14</value>
<value selector="6">6</value>
<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers -->
<value selector="8">8</value>
<value selector="10">10</value>
<value selector="12">12</value>
<value selector="14">14</value>
</Value>

<Value id="var_accounts_maximum_age_login_defs" type="number" >
<title>maximum password age</title>
<description>Maximum age of password in days</description>
<warning category="general">This will only apply to newly created accounts</warning>
<value selector="">60</value>
<value selector="60">60</value>
<value selector="90">90</value>
<value selector="120">120</value>
<value selector="180">180</value>
</Value>

<Value id="var_accounts_minimum_age_login_defs" type="number" >
<title>minimum password age</title>
<description>Minimum age of password in days</description>
<warning category="general">This will only apply to newly created accounts</warning>
<value selector="">7</value>
<value selector="7">7</value>
<value selector="5">5</value>
<value selector="1">1</value>
<value selector="2">2</value>
<value selector="0">0</value>
</Value>


<Value id="var_accounts_password_warn_age_login_defs" type="number" >
<title>warning days before password expires</title>
<description>The number of days' warning given before a password expires.</description>
<warning category="general">This will only apply to newly created accounts</warning>
<value selector="">7</value>
<value selector="0">0</value>
<value selector="7">7</value>
<value selector="14">14</value>
</Value>

<Rule id="accounts_password_minlen_login_defs" severity="medium">
<title>Set Password Minimum Length in login.defs</title>
<description>To specify password length requirements for new accounts,
edit the file <tt>/etc/login.defs</tt> and add or correct the following
lines:
<pre>PASS_MIN_LEN <sub idref="var_accounts_password_minlen_login_defs" /></pre>
<br/><br/>
The DoD requirement is <tt>14</tt>.
The FISMA requirement is <tt>12</tt>.
If a program consults <tt>/etc/login.defs</tt> and also another PAM module
(such as <tt>pam_cracklib</tt>) during a password change operation,
then the most restrictive must be satisfied. See PAM section
for more information about enforcing password quality requirements.
</description>
<ocil clause="it is not set to the required value">
To check the minimum password length, run the command:
<pre>$ grep PASS_MIN_LEN /etc/login.defs</pre>
The DoD requirement is <tt>14</tt>.
</ocil>
<rationale>
Requiring a minimum password length makes password
cracking attacks more difficult by ensuring a larger
search space. However, any security benefit from an onerous requirement
must be carefully weighed against usability problems, support costs, or counterproductive
behavior that may result.
</rationale>
<ident cce="27002-5"  stig="RHEL-06-000050" />
<oval id="accounts_password_minlen_login_defs" value="var_accounts_password_minlen_login_defs"/>
<ref nist="IA-5(f),IA-5(1)(a)" disa="205"/>
<tested by="DS" on="20121026"/>
</Rule>


<Rule id="accounts_minimum_age_login_defs" severity="medium">
<title>Set Password Minimum Age</title>
<description>To specify password minimum age for new accounts,
edit the file <tt>/etc/login.defs</tt>
and add or correct the following line:
<pre>PASS_MIN_DAYS <i><sub idref="var_accounts_minimum_age_login_defs" /></i></pre>
A value of 1 day is considered for sufficient for many
environments.
The DoD requirement is 1. 
</description>
<ocil clause="it is not set to the required value">
To check the minimum password age, run the command:
<pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
The DoD and FISMA requirement is 1. 
</ocil>
<rationale>
Setting the minimum password age protects against
users cycling back to a favorite password
after satisfying the password reuse requirement.
</rationale>
<ident cce="27013-2"  stig="RHEL-06-000051" />
<oval id="accounts_minimum_age_login_defs" value="var_accounts_minimum_age_login_defs"/>
<ref nist="IA-5(f),IA-5(1)(d)" disa="198"/>
<tested by="DS" on="20121026"/>
</Rule>


<Rule id="accounts_maximum_age_login_defs" severity="medium">
<title>Set Password Maximum Age</title>
<description>To specify password maximum age for new accounts,
edit the file <tt>/etc/login.defs</tt>
and add or correct the following line:
<pre>PASS_MAX_DAYS <i><sub idref="var_accounts_maximum_age_login_defs" /></i></pre>
A value of 180 days is sufficient for many environments. 
The DoD requirement is 60.
</description>
<ocil clause="it is not set to the required value">
To check the maximum password age, run the command:
<pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
The DoD and FISMA requirement is 60.
A value of 180 days is sufficient for many environments. 
</ocil>
<rationale>
Setting the password maximum age ensures users are required to
periodically change their passwords. This could possibly decrease
the utility of a stolen password. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.</rationale>
<ident cce="26985-2"  stig="RHEL-06-000053" />
<oval id="accounts_maximum_age_login_defs" value="var_accounts_maximum_age_login_defs"/>
<ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" srg="76" />
<tested by="DS" on="20121026"/>
</Rule>

<Rule id="accounts_password_warn_age_login_defs">
<title>Set Password Warning Age</title>
<description>To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file <tt>/etc/login.defs</tt> and add or correct
 the following line:
<pre>PASS_WARN_AGE <i><sub idref="var_accounts_password_warn_age_login_defs" /></i></pre>
The DoD requirement is 7.
</description>
<ocil clause="it is not set to the required value">
To check the password warning age, run the command:
<pre>$ grep PASS_WARN_AGE /etc/login.defs</pre>
The DoD requirement is 7.
</ocil>
<rationale>
Setting the password warning age enables users to
make the change at a practical time.
</rationale>
<ident cce="26988-6"  stig="RHEL-06-000054" />
<oval id="accounts_password_warn_age_login_defs" value="var_accounts_password_warn_age_login_defs" />
<ref nist="AC-2(2),IA-5(f)" />
<tested by="DS" on="20121026"/>
</Rule>
</Group>

