Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
.../accounts/restrictions/password_expiration.xml | 9 ++++++---
1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 01f0f45..88b3463 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -47,6 +47,7 @@ age, and 7 day warning period with the following command:
<description>Maximum age of password in days</description>
<warning category="general">This will only apply to newly created
accounts</warning>
<value selector="">90</value>
+<value selector="60">60</value>
<value selector="90">90</value>
<value selector="120">120</value>
<value selector="180">180</value>
@@ -128,13 +129,15 @@ after satisfying the password reuse requirement.
edit the file <tt>/etc/login.defs</tt>
and add or correct the following line, replacing <i>DAYS</i> appropriately:
<pre>PASS_MAX_DAYS <i>DAYS</i><!-- <sub
idref="password_max_age_login_defs_value" /> --></pre>
-A value of 180 days is considered for sufficient for many
-environments.
+A value of 180 days is sufficient for many
+environments. The current setting required in DoD is 60 days.
</description>
<rationale>
Setting the password maximum age ensures that users are required to
periodically change their passwords. This could possibly decrease
-the utility of a stolen password.</rationale>
+the utility of a stolen password. Requiring shorter password lifetimes
+increases the risk of users writing down the password in a convenient
+location subject to physical compromise.</rationale>
<ident cce="4092-3" />
<oval id="accounts_maximum_age_login_defs"
value="var_password_max_age"/>
<ref nist="CM-6, CM-7, IA-5, AC-3" disa="199"/>
--
1.7.1