documentation_complete: true

title: 'Set Password Expiration Parameters'

description: |-
    The file <tt>/etc/login.defs</tt> controls several password-related settings.
    Programs such as <tt>passwd</tt>, <tt>su</tt>, and <tt>login</tt> consult <tt>/etc/login.defs</tt> to determine behavior with regard to password aging, expiration warnings, and length.
    See the man page <tt>login.defs(5)</tt> for more information.
    <br /><br />
    Users should be forced to change their passwords, in order to decrease the utility of compromised passwords.
    However, the need to change passwords often should be balanced against the risk that users will reuse or write down passwords if forced to change them too often.
    Forcing password changes every 90-360 days, depending on the environment, is recommended.
    Set the appropriate value as <tt>PASS_MAX_DAYS</tt> and apply it to existing accounts with the <tt>-M</tt> flag.
    <br /><br />
    The <tt>PASS_MIN_DAYS</tt> (<tt>-m</tt>) setting prevents password changes for 7 days after the first change, to discourage password cycling.
    If you use this setting, train users to contact an administrator for an emergency password change in case a new password becomes compromised.
    The <tt>PASS_WARN_AGE</tt> (<tt>-W</tt>) setting gives users 7 days of warnings at login time that their passwords are about to expire.
    <br /><br />
    For example, for each existing human user <i>USER</i>, expiration parameters could be adjusted to a 180 day maximum password age, 7 day minimum password age, and 7 day warning period with the following command:
    <pre># chage -M 180 -m 7 -W 7 USER</pre>
