documentation_complete: true

title: 'Set Password Warning Age'

description: |-
    To specify how many days prior to password
    expiration that a warning will be issued to users,
    edit the file <tt>/etc/login.defs</tt> and add or correct
     the following line:
    <pre>PASS_WARN_AGE <i><sub idref="var_accounts_password_warn_age_login_defs" /></i></pre>
    The DoD requirement is 7.

rationale: |-
    Setting the password warning age enables users to
    make the change at a practical time.

severity: unknown

identifiers:
    cce: 26988-6

references:
    nist: AC-2(2),IA-5(f)
    srg: SRG-OS-999999
    stigid: RHEL-06-000054

ocil_clause: 'it is not set to the required value'

ocil: |-
    To check the password warning age, run the command:
    <pre>$ grep PASS_WARN_AGE /etc/login.defs</pre>
    The DoD requirement is 7.
