On 6/27/12 6:35 PM, Jeffrey Blank wrote:
+<Rule id="account_disable_post_pw_expiration">
+<title>Set Account Expiration Following Inactivity</title>
+<description>To specify the number of days after a password expires
+(which signifies inactivity) until an
+account is permanently disabled, edit the file
<tt>/etc/defaults/useradd</tt>
+and add or correct the following lines, substituting
<tt><i>NUM_DAYS</i></tt> appropriately:
+<pre>INACTIVE=<i>NUM_DAYS</i></pre>
+A value of 35 is recommended. If a password is currently on the
+verge of expiration, then 35 days remain until the account is automatically
+disabled. However, if the password will not expire for another 60 days, then 95
+days could elapse until the account would be automatically disabled. See the
+<tt>useradd</tt> man page for more information. Determining the inactivity
+timeout must be done with careful consideration of the length of a "normal"
+period of inactivity for users in the particular environment. Setting
+the timeout too low incurs support costs and also has the potential to impact
+availability of the system to legitimate users.
+</description>
+<rationale>
nitpick. kinda.
do we want to have them edit text files, or just issue a chage command ala
# chage -I 35 shawn
^ that's an uppercase i
and the idea of using this concept as the definition of 'inactive
account' is novel, I haven't thought of this before!