The Password Aging Policy (Linux) Part I

Hey folks,

In this (Part I) practical based article we'll go through the password (aging) policy in Linux. So, let's get started and know that what is the password aging policy?

In order to ensure system and network security, various security mechanisms are used, which includes user password expiration, determining the time interval d1uring which the password will be in use, forcing users to change their password, sending a warning message to users to change the password before the password expires, and deactivating the user account and so on. Now let's talk about some settings in the password policy. In general, processes related to password policies and measures in Linux are done through the "chage" command and  "/etc/login.defs." file.

There are some following settings in the password aging policy:

• The last password change date - is the date when the last password has been changed by the user;
• The password expiration date - is the last date the password remains valid, after the last date the password is no longer valid;
• The password inactive date - is the deadline for using an expired password, after the deadline the user account will be locked if the expired password is not changed;
• An account expiration date -  is the deadline for the user will be able to use an account, after the deadline the account will be automatically locked;
• The minimum number of days between password change - is the number of days before the user is allowed to rechange the password and the days are calculated from the last password change date;
• The maximum number of days between password change - is the number of days till the password becomes valid and the days are also calculated from the last password change date;
• A number of days of warning before the password expires - is the number of days in which the user will be getting a warning message to change the password before the password expiration date and since the expiration date of the password, the days are calculated in a reverse mode.

To list the password aging settings for the specific user "chage -l" command is used and the following result displays that the password policy settings have been modified for the username (arazahmadov):

$ sudo chage -l arazahmadov
Last password change                                    : Aug 15, 2022
Password expires                                        : Sep 14, 2022  
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 10
Maximum number of days between password change          : 90
Number of days of warning before password expires       : 14

The default value of the password aging policy is stored in "/etc/login.defs." file.

# Password aging controls:
#
#       PASS_MAX_DAYS   Maximum number of days a password may be used.
#       PASS_MIN_DAYS   Minimum number of days allowed between password changes.
#       PASS_MIN_LEN    Minimum acceptable password length.
#       PASS_WARN_AGE   Number of days warning given before a password expires.
#


PASS_MAX_DAYS   60
PASS_MIN_DAYS   1
PASS_MIN_LEN    5
PASS_WARN_AGE   5

The mentioned (/etc/login.defs.) fil applies it's default settings for the new created users in Linux system. For instance:

$ sudo chage -l TestUser
Last password change                                    : Aug 21, 2022
Password expires                                        : Oct 20, 2022
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 1
Maximum number of days between password change          : 60
Number of days of warning before password expires       : 5

Dear folks,

I guess and hope this (Part I) article I wrote about the password aging policies, will be helpful for your enlightenment.

Thank you

Sincerely,

Author,

Araz Ahmadov