[PATCH 4/4] added support for setting password expiration to 60 days * and some additional rationale text

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jul 30 15:10:49 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 .../accounts/restrictions/password_expiration.xml  |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 01f0f45..88b3463 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -47,6 +47,7 @@ age, and 7 day warning period with the following command:
 <description>Maximum age of password in days</description>
 <warning category="general">This will only apply to newly created accounts</warning>
 <value selector="">90</value>
+<value selector="60">60</value>
 <value selector="90">90</value>
 <value selector="120">120</value>
 <value selector="180">180</value>
@@ -128,13 +129,15 @@ after satisfying the password reuse requirement.
 edit the file <tt>/etc/login.defs</tt>
 and add or correct the following line, replacing <i>DAYS</i> appropriately:
 <pre>PASS_MAX_DAYS <i>DAYS</i><!-- <sub idref="password_max_age_login_defs_value" /> --></pre>
-A value of 180 days is considered for sufficient for many
-environments.
+A value of 180 days is sufficient for many
+environments. The current setting required in DoD is 60 days.
 </description>
 <rationale>
 Setting the password maximum age ensures that users are required to
 periodically change their passwords. This could possibly decrease
-the utility of a stolen password.</rationale>
+the utility of a stolen password. Requiring shorter password lifetimes
+increases the risk of users writing down the password in a convenient
+location subject to physical compromise.</rationale>
 <ident cce="4092-3" />
 <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
 <ref nist="CM-6, CM-7, IA-5, AC-3" disa="199"/>
-- 
1.7.1



More information about the scap-security-guide mailing list