17 January 2008

Set default password expiry policy for all users in Linux

The /etc/login.defs file defines the site-wide configuration for password expiry.

Each line of the file describing one configuration parameter.The lines consist of a configuration name and value, separated by whitespace.
We need to set default password expiry using /etc/login.defs file:
  1. PASS_MAX_DAYS : Maximum number of days a password may be used. If the password is older than this, a password change will be forced.
  2. PASS_MIN_DAYS : Minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected
  3. PASS_WARN_AGE : Number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a negative value means no warning is given. If not specified, no warning will be provided.
E.g.,

PASS_MAX_DAYS 30
PASS_MIN_DAYS 15
PASS_WARN_AGE 7

No comments: