Set Password Minimum Age

Description

To specify password minimum age for new accounts, edit the file /etc/login.defs and add or correct the following line:

PASS_MIN_DAYS 1

A value of 1 day is considered sufficient for many environments. The DoD requirement is 1. The profile requirement is 1.

Rationale

Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization’s policy regarding password reuse.

Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'login' 2>/dev/null | grep -q installed; then

var\_accounts\_minimum\_age\_login\_defs='1'


grep -q ^PASS\_MIN\_DAYS /etc/login.defs && \
 sed -i "s/PASS\_MIN\_DAYS.\*/PASS\_MIN\_DAYS $var\_accounts\_minimum\_age\_login\_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
 echo "PASS\_MIN\_DAYS $var\_accounts\_minimum\_age\_login\_defs" >> /etc/login.defs
fi

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi