documentation_complete: true

prodtype: rhel7

title: 'Set Existing Passwords Maximum Age'

description: |-
    Configure non-compliant accounts to enforce a 60-day maximum password lifetime
    restriction by running the following command:
    <pre>$ sudo chage -M 60 <i>USER</i></pre>

rationale: |-
    Any password, no matter how complex, can eventually be cracked. Therefore,
    passwords need to be changed periodically. If the operating system does
    not limit the lifetime of passwords and force users to change their
    passwords, there is the risk that the operating system passwords could be
    compromised.

severity: medium

identifiers:
    cce: 80522-6

references:
    disa: 199
    nist: ""
    srg: SRG-OS-000076-GPOS-00044
    stigid: "010260"

ocil_clause: 'existing passwords are not configured correctly'

ocil: "Check whether the maximum time period for existing passwords is restricted to\n60 days by running the following command for each user:\n<pre>$ sudo chage -l <i>USER</i> | grep Maximum</pre>\nThe output for each user should return something similary to the following:\n<pre>Maximum number of days between password change\t\t: 60</pre>"
