documentation_complete: true

title: 'Set Password Maximum Age'

description: "To specify password maximum age for new accounts,\nedit the file <tt>/etc/login.defs</tt>\nand add or correct the following line:\n<pre>PASS_MAX_DAYS <i><sub idref=\"var_accounts_maximum_age_login_defs\" /></i></pre>\nA value of 180 days is sufficient for many environments. \nThe DoD requirement is 60."

rationale: |-
    Setting the password maximum age ensures users are required to
    periodically change their passwords. This could possibly decrease
    the utility of a stolen password. Requiring shorter password lifetimes
    increases the risk of users writing down the password in a convenient
    location subject to physical compromise.

severity: medium

identifiers:
    cce: 26985-2

references:
    disa: 180,199
    nist: IA-5(f),IA-5(g),IA-5(1)(d)
    pcidss: Req-8.2.4
    srg: SRG-OS-000076
    stigid: RHEL-06-000053

ocil_clause: 'it is not set to the required value'

ocil: |-
    To check the maximum password age, run the command:
    <pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
    The DoD and FISMA requirement is 60.
    A value of 180 days is sufficient for many environments.
