<Group id="password_expiration">
<title>Set Password Expiration Parameters</title>
<description>The file <tt>/etc/login.defs</tt> controls several
password-related settings. Programs such as <tt>passwd</tt>,
<tt>su</tt>, and <tt>login</tt> consult <tt>/etc/login.defs</tt> to determine
behavior with regard to password aging, expiration warnings,
and length. See the man page <tt>login.defs(5)</tt> for more information.
<br/><br/>
Users should be forced to change their passwords, in order to
decrease the utility of compromised passwords. However, the need to
change passwords often should be balanced against the risk that
users will reuse or write down passwords if forced to change them
too often. Forcing password changes every 90-360 days, depending on
the environment, is recommended. Set the appropriate value as
<tt>PASS_MAX_DAYS</tt> and apply it to existing accounts with the
<tt>-M</tt> flag.
<br /><br />
The <tt>PASS_MIN_DAYS</tt> (<tt>-m</tt>) setting prevents password
changes for 7 days after the first change, to discourage password
cycling. If you use this setting, train users to contact an administrator
for an emergency password change in case a new password becomes
compromised. The <tt>PASS_WARN_AGE</tt> (<tt>-W</tt>) setting gives
users 7 days of warnings at login time that their passwords are about to expire.
<br /><br />
For example, for each existing human user <i>USER</i>, expiration parameters
could be adjusted to a 180 day maximum password age, 7 day minimum password
age, and 7 day warning period with the following command:
<pre># chage -M 180 -m 7 -W 7 USER</pre>
</description>

<Value id="var_accounts_password_minlen_login_defs" type="number" >
<title>minimum password length</title>
<description>Minimum number of characters in password</description>
<warning category="general">This will only check new passwords</warning>
<value selector="">12</value>
<value selector="6">6</value>
<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers -->
<value selector="8">8</value>
<value selector="10">10</value>
<value selector="12">12</value>
<value selector="14">14</value>
</Value>

<Value id="var_accounts_maximum_age_login_defs" type="number" >
<title>maximum password age</title>
<description>Maximum age of password in days</description>
<warning category="general">This will only apply to newly created accounts</warning>
<value selector="">60</value>
<value selector="60">60</value>
<value selector="90">90</value>
<value selector="120">120</value>
<value selector="180">180</value>
</Value>

<Value id="var_accounts_minimum_age_login_defs" type="number" >
<title>minimum password age</title>
<description>Minimum age of password in days</description>
<warning category="general">This will only apply to newly created accounts</warning>
<value selector="">7</value>
<value selector="7">7</value>
<value selector="5">5</value>
<value selector="1">1</value>
<value selector="2">2</value>
<value selector="0">0</value>
</Value>

<Value id="var_accounts_password_warn_age_login_defs" type="number" >
<title>warning days before password expires</title>
<description>The number of days' warning given before a password expires.</description>
<warning category="general">This will only apply to newly created accounts</warning>
<value selector="">7</value>
<value selector="0">0</value>
<value selector="7">7</value>
<value selector="14">14</value>
</Value>

<Rule id="accounts_password_minlen_login_defs" severity="medium">
<title>Password Minimum Length</title>
<description>To specify password length requirements for new accounts,
edit the file <tt>/etc/login.defs</tt>, locate the following line:
<pre>PASS_MIN_LEN <b>LENGTH</b></pre>
and correct it to have the form of:
<pre>PASS_MIN_LEN <b><sub idref="var_accounts_password_minlen_login_defs" /></b></pre>
<br />
Nowadays recommended values, considered as secure by various organizations
focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to
<tt>14 (DoD)</tt> characters for password length requirements.
If a program consults <tt>/etc/login.defs</tt> and also another PAM module
(such as <tt>pam_pwquality</tt>) during a password change operation,
then the most restrictive must be satisfied. See PAM section
for more information about enforcing password quality requirements.
</description>
<ocil clause="it is not set to the required value">
To check the minimum password length, run the command:
<pre>$ grep PASS_MIN_LEN /etc/login.defs</pre>
Passwords of length <tt>12</tt> characters and more are nowadays
considered to be a standard requirement.
</ocil>
<rationale>
Requiring a minimum password length makes password
cracking attacks more difficult by ensuring a larger
search space. However, any security benefit from an onerous requirement
must be carefully weighed against usability problems, support costs, or
counterproductive behavior that may result.
</rationale>
<oval id="accounts_password_minlen_login_defs" value="var_accounts_password_minlen_login_defs"/>
<ref nist="IA-5(f),IA-5(1)(a)" disa="205"/>
</Rule>

<Rule id="accounts_minimum_age_login_defs" severity="medium">
<title>Password Minimum Age</title>
<description>To specify password minimum age for new accounts,
edit the file <tt>/etc/login.defs</tt>, locate the following line:
<pre>PASS_MIN_DAYS <b>DAYS</b></pre>
and correct it to have the form of:
<pre>PASS_MIN_DAYS <b><sub idref="var_accounts_minimum_age_login_defs" /></b></pre>
<br />
A value greater than 1 day is considered to be sufficient for many environments.
</description>
<ocil clause="it is not set to the required value">
To check the minimum password age, run the command:
<pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
A value greater than 1 day is considered to be sufficient for many environments.
</ocil>
<rationale>
Setting the minimum password age protects against users cycling
back to a favorite password after satisfying the password reuse
requirement.
</rationale>
<oval id="accounts_minimum_age_login_defs" value="var_accounts_minimum_age_login_defs"/>
<ref nist="IA-5(f),IA-5(1)(d)" disa="198"/>
</Rule>

<Rule id="accounts_maximum_age_login_defs" severity="medium">
<title>Password Maximum Age</title>
<description>To specify password maximum age for new accounts,
edit the file <tt>/etc/login.defs</tt>, locate the following line:
<pre>PASS_MAX_DAYS <b>DAYS</b></pre>
and correct it to have the form of:
<pre>PASS_MAX_DAYS <b><sub idref="var_accounts_maximum_age_login_defs" /></b></pre>
<br />
A value less than 180 days is sufficient for many environments.
</description>
<ocil clause="it is not set to the required value">
To check the maximum password age, run the command:
<pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
A value less than 180 days is sufficient for many environments.
</ocil>
<rationale>
Setting the password maximum age ensures users are required to
periodically change their passwords. This could possibly decrease
the utility of a stolen password. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.</rationale>
<oval id="accounts_maximum_age_login_defs" value="var_accounts_maximum_age_login_defs"/>
<ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" />
</Rule>

<Rule id="accounts_password_warn_age_login_defs">
<title>Password Warning Age</title>
<description>To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file <tt>/etc/login.defs</tt>, locate the following line:
<pre>PASS_WARN_AGE <b>DAYS</b></pre>
and correct it to have the form of:
<pre>PASS_WARN_AGE <b><sub idref="var_accounts_password_warn_age_login_defs" /></b></pre>
<br />
A value of 7 days would be nowadays considered to be a standard.
</description>
<ocil clause="it is not set to the required value">
To check the password warning age, run the command:
<pre>$ grep PASS_WARN_AGE /etc/login.defs</pre>
A value of 7 days would be nowadays considered to be a standard.
</ocil>
<rationale>
Setting the password warning age enables users to make the change
at a practical time.
</rationale>
<oval id="accounts_password_warn_age_login_defs" value="var_accounts_password_warn_age_login_defs" />
<ref nist="IA-5(f)" />
</Rule>

</Group>
