# Ensure minimum password days is configured (Manual)

The 'PASS_MIN_DAYS' parameter specifies the minimum number of days that must pass before a user is allowed to change their password. Setting this value is crucial for preventing users from immediately changing their password back to a previous one after a forced reset, which would otherwise circumvent the 'password history' policy. Misconfiguration leaves the system vulnerable to users reusing weak or compromised passwords.

The audit script verifies the current configuration by reading the 'PASS_MIN_DAYS' value directly from '/etc/login.defs'. The remediation script modifies this file to set the desired minimum password age for all newly created user accounts.

The recommended states are justified as follows:
- **Basic [1]:** Enforcing a minimum of 1 day is the baseline requirement. It ensures a password cannot be changed and then immediately changed back on the same day, which is the most basic form of defeating password history enforcement.
- **Moderate [7]:** A value of 7 days is a widely recognized security best practice, recommended by benchmarks like CIS. It forces a new password to be used for a full week, significantly strengthening the password history control and giving administrators time to detect and respond if a user's new temporary password was somehow compromised.
- **Strict [7]:** The strict recommendation aligns with the moderate state, as 7 days is considered the industry standard for this control. Increasing this value further provides little additional security benefit and can introduce usability problems if a user has a legitimate reason for an urgent password change (e.g., suspected compromise).

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 7]` |
| **Moderate** | `[7, 7]` |
| **Strict** | `[7, 7]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that reads the '/etc/login.defs' file to find the 'PASS_MIN_DAYS' parameter. The script must parse the file, ignore any commented-out lines, and return only the numerical value associated with this parameter, with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single numerical value as a positional command-line argument. The script must locate the 'PASS_MIN_DAYS' parameter in '/etc/login.defs' and update its value to the one provided. If the parameter does not exist, the script must add it. The script must return 'true' upon successful modification or 'false' if an error occurs (e.g., invalid input).

