documentation_complete: true

prodtype: rhel7

title: 'Set Existing Passwords Minimum Age'

description: |-
    Configure non-compliant accounts to enforce a 24 hours/1 day minimum password
    lifetime by running the following command:
    <pre>$ sudo chage -m 1 <i>USER</i></pre>

rationale: |-
    Enforcing a minimum password lifetime helps to prevent repeated password
    changes to defeat the password reuse or history enforcement requirement. If
    users are allowed to immediately and continually change their password, the
    password could be repeatedly changed in a short period of time to defeat the
    organization's policy regarding password reuse.

severity: medium

identifiers:
    cce: 80521-8

references:
    disa: 198
    nist: ""
    srg: SRG-OS-000075-GPOS-00043
    stigid: "010240"

ocil_clause: 'existing passwords are not configured correctly'

ocil: "Check whether the minimum time period between password changes for each user\naccount is one day or greater by running the following command for each user:\n<pre>$ sudo chage -l <i>USER</i> | grep Minimum</pre>\nThe output for each user should return something similary to the following:\n<pre>Minimum number of days between password change\t\t: 1</pre>"
