Servers – Ensure Password Expiration Days is 365 or Less

Support > Fixing Checks > Server

06 March, 2026

This check ensures that password expiration days are set to 365 or less.

The PASS_MAX_DAYS parameter defines the maximum number of days a password is valid before it must be changed. Setting a reasonable expiration period helps reduce the risk of compromised credentials being used over long periods.

Check Details

Resource: Server
Check: Ensure password expiration is 365 days or less
Risk: Longer password lifetimes increase the risk of credential compromise and prolonged unauthorized access.

Remediation Steps

Open a terminal session on the server with root or sudo privileges.
Check the current password expiration setting:
```
grep PASS_MAX_DAYS /etc/login.defs
```

Verify user-specific password expiration settings:

grep -E '^[^:]+:[^!*]' /etc/shadow | cut -d: -f1,5

Open the login definitions file for editing:
```
sudo nano /etc/login.defs
```
Locate or set the following parameter:
```
PASS_MAX_DAYS 365
```
Update password expiration settings for existing users:
```
sudo chage --maxdays 365 <user>
```
Repeat the above step for all users with passwords configured on the system.
Verify that the changes have been applied successfully by re-running the audit commands.
Perform regular audits to ensure password policies remain compliant with security standards.

Other Articles

Servers – Ensure Password Expiration Days is 365 or Less

Check Details

Remediation Steps