TMA-LNX-PAM-MAXDAYS
Ensure password expiration is 365 days or less
MediumLevel 1Automatedlinux
Description
PASS_MAX_DAYS in /etc/login.defs should be 365 or less.
How it is checked
Audit method: File pattern
- File
/etc/login.defs- Pattern
(?m)^\s*PASS_MAX_DAYS\s+([1-9]|[1-9]\d|[12]\d\d|3[0-5]\d|36[0-5])\s*$
How it is fixed
Fix method: File edit
- File
/etc/login.defs- Replacement line
PASS_MAX_DAYS 365
Properties
- Operating systems
- ubuntu-22.04, ubuntu-24.04, rocky-9
- Tags
- passwordaccounts
- Reference
- CIS Linux Benchmark - User Accounts and Environment / Shadow Password Suite Parameters
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target linux