Set Password Minimum Age
An XCCDF Rule
Description
To specify password minimum age for new accounts,
edit the file /etc/login.defs
and add or correct the following line:
PASS_MIN_DAYSA value of 1 day is considered sufficient for many environments. The DoD requirement is 1. The profile requirement is
Rationale
Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password,
then the password could be repeatedly changed in a short period of time to
defeat the organization's policy regarding password reuse.
Setting the minimum password age protects against users cycling back to a
favorite password after satisfying the password reuse requirement.
- ID
- xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs
- Severity
- Medium
- References
- Updated