# Ensure password expiration is configured

Necessity: Enforcing password expiration limits the duration a compromised password can be used by an attacker. Regular password changes mitigate risks associated with credential theft, brute-force attacks, and password reuse. Failing to enforce a maximum password age leaves accounts vulnerable indefinitely if their credentials are ever exposed. This setting in `/etc/login.defs` establishes the default policy for all newly created user accounts. Auditing and Remediation: The audit script reads the `PASS_MAX_DAYS` value directly from the `/etc/login.defs` configuration file to determine the default maximum number of days a password may be used. The remediation script modifies this file, updating the `PASS_MAX_DAYS` parameter to the desired value, thereby enforcing the new password expiration policy for any user accounts created thereafter. Recommended State Rationale: The recommended states provide a tiered approach to password security. 'Basic' ([90, 90]) establishes a quarterly password change cycle, which is a widely accepted baseline for balancing security and usability. 'Moderate' ([60, 60]) enhances security by reducing the credential's valid lifetime, shortening the window of opportunity for an attacker. 'Strict' ([1, 30]) is intended for high-security environments, significantly limiting the utility of a compromised password by forcing frequent changes. The lower bound of 1 ensures the policy is active and not set to an indefinite value.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[90, 30]` |
| **Moderate** | `[60, 30]` |
| **Strict** | `[1, 30]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the `/etc/login.defs` file for the `PASS_MAX_DAYS` parameter. The script must parse the file to find the numerical value assigned to `PASS_MAX_DAYS` and output only this value.

## Remediation Script Working

Bash script that accepts a single numerical value as a direct, positional command-line argument. The script must modify the `/etc/login.defs` file to set the `PASS_MAX_DAYS` parameter to the provided value. If the parameter is commented out or does not exist, it should be added. The script must return `true` on success and `false` on failure.

