# Ensure minimum password days is configured (Manual)

The 'PASS_MIN_DAYS' parameter specifies the minimum number of days that must pass before a user is allowed to change their password. Setting this parameter is crucial for preventing users from circumventing password history controls. Without this setting, a user could rapidly change their password multiple times in a single session to cycle back to a previous, familiar password that would otherwise be disallowed by the 'Enforce password history' policy. This mitigates the risk of password reuse, a common vulnerability that attackers exploit. The audit script verifies the current value configured in '/etc/login.defs', while the remediation script sets it to the desired value. A Basic state of 1 day provides minimal protection against immediate password cycling. A Moderate state of 7 days, often recommended by security benchmarks like CIS, provides a reasonable barrier. A Strict state of 14 or more days makes it highly impractical for users to defeat password history mechanisms, strongly encouraging better password hygiene.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 7]` |
| **Moderate** | `[7, 7]` |
| **Strict** | `[7, 7]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the '/etc/login.defs' file for the 'PASS_MIN_DAYS' parameter. The script must parse the file to find the uncommented line for 'PASS_MIN_DAYS' and return only its numerical value, with no extra text or labels.

## Remediation Script Working

Bash script that configures the 'PASS_MIN_DAYS' parameter in '/etc/login.defs'. The script must accept the desired number of days as a direct, positional command-line argument (e.g., './script.sh 7'). It should find and update the existing uncommented 'PASS_MIN_DAYS' line or add it if it does not exist. The script must return 'true' on successful modification and 'false' on failure.

