User passwords must be changed at least every 60 days.

From SOLARIS 10 SPARC SECURITY TECHNICAL IMPLEMENTATION GUIDE

Associated with IA controls: IAIA-2, IAIA-1

Associated with: CCI-000180

SV-39845r3_rule User passwords must be changed at least every 60 days.

Vulnerability discussion

Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password.

Check content

Check the max days field (the 5th field) of /etc/shadow. # awk -F: '{print $1 ":" $5;}' /etc/shadow If the max days field is equal to 0 or greater than 60 for any account that is not password-locked, this is a finding.

Fix text

Set the max days field to 60 for all user accounts. # passwd -x 60 Set the MAXWEEKS parameter in /etc/default/passwd to a positive, non-zero value of 8 or less.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.