User passwords must be changed at least every 60 days.

From Oracle Linux 5 Security Technical Implementation Guide

Associated with: CCI-000180

SV-64083r1_rule User passwords must be changed at least every 60 days.

Vulnerability discussion

Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password.

Check content

Check the max days field (the 5th field) of /etc/shadow. # more /etc/shadow If the max days field is equal to 0 or greater than 60 for any user, this is a finding.

Fix text

Set the max days field to 60 for all user accounts. # passwd -x 60

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.