documentation_complete: true

title: 'Set Password Expiration Parameters'

description: |-
    The file <tt>/etc/login.defs</tt> controls several
    password-related settings. Programs such as <tt>passwd</tt>,
    <tt>su</tt>, and
    <tt>login</tt> consult <tt>/etc/login.defs</tt> to determine
    behavior with regard to password aging, expiration warnings,
    and length. See the man page <tt>login.defs(5)</tt> for more information.
    <br /><br />
    Users should be forced to change their passwords, in order to
    decrease the utility of compromised passwords. However, the need to
    change passwords often should be balanced against the risk that
    users will reuse or write down passwords if forced to change them
    too often. Forcing password changes every 90-360 days, depending on
    the environment, is recommended. Set the appropriate value as
    <tt>PASS_MAX_DAYS</tt> and apply it to existing accounts with the
    <tt>-M</tt> flag.
    <br /><br />
    The <tt>PASS_MIN_DAYS</tt> (<tt>-m</tt>) setting prevents password
    changes for 7 days after the first change, to discourage password
    cycling. If you use this setting, train users to contact an administrator
    for an emergency password change in case a new password becomes
    compromised. The <tt>PASS_WARN_AGE</tt> (<tt>-W</tt>) setting gives
    users 7 days of warnings at login time that their passwords are about to expire.
    <br /><br />
    For example, for each existing human user <i>USER</i>, expiration parameters
    could be adjusted to a 180 day maximum password age, 7 day minimum password
    age, and 7 day warning period with the following command:
    <pre>$ sudo chage -M 180 -m 7 -W 7 USER</pre>
