# Ensure inactive password lock is configured

The inactive password lock setting defines the number of days after a password expires that the account will be disabled. This is a crucial security control to prevent the misuse of dormant or abandoned accounts. An attacker who compromises credentials for an account with an expired password could still use it if the account remains active. By automatically locking these accounts, this setting reduces the available attack surface. The audit script checks the `INACTIVE` value in the `/etc/default/useradd` configuration file, which sets the default for all newly created user accounts. The remediation script modifies this default value using the `useradd` utility. The recommended states provide a progressively shorter grace period before an account is locked. A Basic state of 30 days is a common industry baseline (e.g., CIS) that balances security with user convenience. A Moderate state of 15 days shortens the exposure window, while a Strict state of 7 days enforces a rapid lockout, significantly minimizing the risk from accounts with expired credentials at the cost of requiring more prompt user action.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[30, 7]` |
| **Moderate** | `[15, 7]` |
| **Strict** | `[7, 7]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that reads the `/etc/default/useradd` file. The script must find the line starting with `INACTIVE=` (ignoring commented lines) and output only the numerical value assigned to it. If the `INACTIVE` parameter is not set, is commented out, or is set to a non-positive value, the script should output `-1`.

## Remediation Script Working

Bash script that accepts a single positive integer as a command-line argument. The script must use the `useradd -D -f <argument>` command to update the default password inactivity setting. The script must return `true` on successful execution and `false` if it fails or if the input is not a positive integer.

