documentation_complete: true

title: 'Password Warning Age'

description: |-
    To specify how many days prior to password expiration that a warning will be issued to users, edit the file <tt>/etc/login.defs</tt>, locate the following line:
    <pre>PASS_WARN_AGE <b>DAYS</b></pre>
    and correct it to have the form of:
    <pre>PASS_WARN_AGE <b><sub idref="var_accounts_password_warn_age_login_defs" /></b></pre>
    <br />
    A value of 7 days would be nowadays considered to be a standard.

rationale: 'Setting the password warning age enables users to make the change at a practical time.'

severity: unknown

references:
    nist: IA-5(f)

ocil_clause: 'it is not set to the required value'

ocil: |-
    To check the password warning age, run the command:
    <pre>$ grep PASS_WARN_AGE /etc/login.defs</pre>
    A value of 7 days would be nowadays considered to be a standard.
