# Ensure password expiration warning days is configured

Necessity: Setting a password expiration warning period is crucial for user account management and operational continuity. It provides users with advance notice before their password expires, allowing them to change it at a convenient time. This prevents unexpected account lockouts, which can disrupt productivity, increase help desk workload, and lead to users adopting insecure practices if forced to reset passwords under pressure. Without a warning, users might be locked out of critical systems, unable to perform their duties until their access is restored. 

Auditing and Remediation: The audit script inspects the `/etc/login.defs` configuration file to determine the current system-wide default for the number of days a warning is given before a password expires. This is defined by the `PASS_WARN_AGE` parameter. The remediation script directly modifies this file to set the `PASS_WARN_AGE` parameter to the desired value, ensuring all newly created user accounts inherit the specified warning period. 

Recommended State Rationale: 
- Basic: A value of `7` is recommended as a baseline, aligning with CIS Benchmarks. This provides users with a one-week notice, which is generally sufficient to avoid lockouts in a typical office environment. 
- Moderate: A value of `14` offers a more flexible two-week warning period. This is beneficial for environments where users may be on short-term leave or travel, reducing the risk that they miss the warning notifications entirely. 
- Strict: A value of `30` provides a month-long warning, which is suitable for organizations with personnel who have infrequent system access or travel for extended periods. This level maximizes the opportunity for users to change their password, virtually eliminating expiration-related lockouts, though it may risk users becoming desensitized to the prolonged warnings.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[7, 30]` |
| **Moderate** | `[14, 30]` |
| **Strict** | `[30, 30]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the `/etc/login.defs` file to find the value of the `PASS_WARN_AGE` parameter. The script must parse the file, locate the uncommented `PASS_WARN_AGE` line, and output only the numerical value associated with it, with no extra text or labels.

## Remediation Script Working

Bash script that takes a single numerical value as a positional command-line argument. The script should use this argument to set the `PASS_WARN_AGE` parameter in the `/etc/login.defs` file. If the parameter already exists (commented or uncommented), its value should be updated. If it does not exist, it should be added. The script must return `true` if the modification is successful and `false` otherwise.

