<def-group>
  <definition class="compliance" id="accounts_password_set_min_life_existing" version="1">
      {{{ oval_metadata("Passwords for existing accounts much satisfy minimum age requirements") }}}
    <criteria operator="AND">
      <criterion comment="Passwords must be restricted to the appropriate minimum age for existing accounts." test_ref="test_password_min_life_existing" />
      <criterion comment="Passwords must have a minimum lifetime less than or equal to the defined maximum." test_ref="test_password_min_life_existing_maximum" />
    </criteria>
  </definition>

  <!-- Define a test for the shadow file for accounts with passwords to look for the minimum password change interval. -->
  <unix:shadow_test
      id="test_password_min_life_existing" 
      check="all"
      check_existence="at_least_one_exists"
      version="1" 
      comment="Password minimum lifetime for existing accounts is at least what is defined by policy.">
    <unix:object object_ref="object_shadow_password_users_min_life_existing"/>
    <unix:state state_ref="min_password_change_interval"/>
  </unix:shadow_test>

  <!-- Define a second test to ensure the minimum password life is at less than the defined maximum. -->
  <unix:shadow_test id="test_password_min_life_existing_maximum"  check="all" check_existence="at_least_one_exists" version="1" comment="Password minimum life entry is at mosta defined maximum">
    <unix:object object_ref="object_shadow_password_users_min_life_existing"/>
    <unix:state state_ref="max_min_password_change_interval"/>
  </unix:shadow_test>

  <unix:shadow_object id="object_shadow_password_users_min_life_existing" version="1">
    <unix:username operation="pattern match">.*</unix:username>
  </unix:shadow_object>

  <unix:shadow_state id="max_min_password_change_interval" version="1" comment="change passwords every maximum interval or less">
    <unix:chg_allow
      operation="less than or equal"
      datatype="int"
      var_ref="var_accounts_maximum_age_login_defs"/>
  </unix:shadow_state>

  <unix:shadow_state id="min_password_change_interval" version="1" comment="change passwords at at the recommended interval or more">
    <unix:chg_allow
      operation="greater than or equal"
      datatype="int"
      var_ref="var_accounts_minimum_age_login_defs"/>
  </unix:shadow_state>

  <!-- these external variables are defined at the group level, reusing the account-level definitions. -->
  <external_variable
      comment="Maximum password age"
      datatype="int"
      id="var_accounts_maximum_age_login_defs"
      version="1" />

  <external_variable
      comment="Minimum password age"
      datatype="int"
      id="var_accounts_minimum_age_login_defs"
      version="1" />


</def-group>
