# Ensure inactive password lock is configured

Necessity: Setting an inactive password lock ensures that an account is automatically disabled after its password has expired for a specified number of days. This is a critical security control that mitigates the risk of an attacker gaining access to and using an abandoned or unmonitored account with an expired password. Without this setting, an expired account could remain a viable target indefinitely, providing a potential foothold for unauthorized access.

Auditing and Remediation: The audit script checks the `INACTIVE` parameter in the `/etc/default/useradd` file. This file defines the default settings applied to all newly created user accounts. A value of -1, 0, or the absence of the parameter indicates that the feature is disabled. The remediation script uses the `useradd -D -f` command to modify this default setting, ensuring that all future accounts will inherit the secure configuration. Note that this change does not affect existing user accounts, which must be updated individually using the `chage` command.

Recommended State Rationale:
- Basic: `[30, 30]`. This value is aligned with security standards like the CIS Benchmarks. It provides a 30-day grace period after a password expires before locking the account, balancing security with user convenience by giving users ample time to reset their password.
- Moderate: `[15, 15]`. A 15-day period reduces the window of opportunity for an attacker to compromise and use an account with an expired password. This state is suitable for environments requiring tighter controls and faster user compliance with password policies.
- Strict: `[7, 7]`. In high-security environments, a 7-day period drastically minimizes the time an expired account remains accessible. This enforces rapid password management and significantly reduces the attack surface, though it may increase help desk tickets if users do not act promptly.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[30, 7]` |
| **Moderate** | `[15, 7]` |
| **Strict** | `[7, 7]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the `/etc/default/useradd` file to find the value of the `INACTIVE` parameter. The script should use `grep` and `cut` to isolate the numerical value. If the `INACTIVE` parameter is not set, is empty, or is set to a value less than 1 (such as -1 or 0), the script should return `0`. The script must only output the final numerical value and no other text.

## Remediation Script Working

Bash script that accepts a single numerical command-line argument. The script must use this argument to set the system-wide default for inactive password locking by executing `useradd -D -f <value>`. The script must check the command's exit code and output `true` on success or `false` on failure.

