# Ensure password expiration warning days is configured

Necessity: Setting a password expiration warning period is crucial for user account management and operational continuity. It alerts users that their password is about to expire, giving them sufficient time to choose a new one. This proactive notification prevents unexpected account lockouts, which can disrupt workflow, deny access to critical systems, and increase the workload on IT support staff. Misconfiguration or disabling this feature can lead to user frustration and a loss of productivity.

Auditing and Remediation: The audit script inspects the `/etc/login.defs` configuration file to verify the current value of the `PASS_WARN_AGE` parameter, which dictates how many days before password expiration a warning is issued. The remediation script directly modifies this file, setting the `PASS_WARN_AGE` parameter to the value provided as a command-line argument. This configuration affects all newly created user accounts on the system.

Recommended State Rationale:
- Basic [7, 7]: This level aligns with CIS (Center for Internet Security) benchmarks. A 7-day warning provides a one-week notice, which is generally considered the minimum acceptable period for users to take action without causing undue disruption.
- Moderate [14, 14]: A 14-day warning period offers a more generous timeframe. This is beneficial in environments where users may not log in daily, such as those who travel or work intermittently, ensuring they receive the warning with ample time to respond.
- Strict [14, 'upper bound']: A strict policy sets the warning period to at least two weeks. This provides maximum advance notice, significantly reducing the likelihood of accidental lockouts. While longer periods are possible, 14 days strikes a balance between providing sufficient warning and avoiding 'notification fatigue,' where users might ignore overly frequent or premature alerts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[7, 30]` |
| **Moderate** | `[14, 30]` |
| **Strict** | `[30, 30]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that reads the `/etc/login.defs` file, finds the line for `PASS_WARN_AGE`, and prints only the numeric value associated with it. The output must be a single number with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional numeric argument representing the desired number of password warning days. The script must modify the `PASS_WARN_AGE` parameter in `/etc/login.defs` to this new value. It should create the parameter if it does not exist. The script must output `true` on successful modification or `false` if it fails.

