# Ensure password expiration is configured

Necessity: Enforcing password expiration is a fundamental security control that limits the duration an attacker can use a compromised password. Without a maximum password age, a stolen credential could provide indefinite access. This setting mitigates risks associated with long-term password reuse, brute-force attacks on static passwords, and credentials exposed in third-party data breaches. A misconfiguration, such as setting the value to -1 or 99999 (infinity), effectively disables this protection, leaving accounts perpetually vulnerable.

Auditing and Remediation: The audit script checks the system-wide default setting for password expiration by reading the `PASS_MAX_DAYS` value from the `/etc/login.defs` configuration file. The remediation script directly modifies this file, updating the `PASS_MAX_DAYS` parameter to enforce a new maximum password age for all newly created user accounts.

Recommended State Rationale:
- Basic: `[90, 90]` sets a 90-day password expiration policy. This is a widely accepted industry standard, often cited in benchmarks like CIS Level 1, that balances security with user convenience by preventing password fatigue while ensuring periodic credential rotation.
- Moderate: `[60, 60]` increases the frequency of password changes to every 60 days. This is suitable for environments handling sensitive but not highly critical data, as it reduces the window of opportunity for an attacker to exploit a compromised password.
- Strict: `[30, 30]` enforces a 30-day expiration, a requirement for high-security environments, such as those governed by PCI-DSS or handling highly sensitive PII. This significantly minimizes the risk by providing the shortest practical lifespan for any given password.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[90, 30]` |
| **Moderate** | `[60, 30]` |
| **Strict** | `[1, 30]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that inspects the `/etc/login.defs` file for the `PASS_MAX_DAYS` parameter. The script must parse this file and output only the numeric value associated with this parameter, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional integer argument representing the desired maximum number of days for password validity. The script must modify the `PASS_MAX_DAYS` parameter in `/etc/login.defs` to this new value. If the parameter does not exist, the script must add it. The script must return `true` upon successful modification or `false` if it fails.

