Other Articles

Servers – Ensure Minimum Days Between Password Changes is 7 or More

Support > Fixing Checks > Server

06 March, 2026

This check ensures that minimum days between password changes is set to 7 or more.

The PASS_MIN_DAYS parameter defines the minimum number of days a user must wait before changing their password again. Setting this value helps prevent users from bypassing password history policies by repeatedly changing passwords.

Check Details

  • Resource: Server
  • Check: Ensure minimum days between password changes is 7 or more
  • Risk: If users can change passwords frequently, they may reuse old passwords and bypass password history controls.

Remediation Steps

  1. Open a terminal session on the server with root or sudo privileges.

  2. Check the current value of PASS_MIN_DAYS:

    grep PASS_MIN_DAYS /etc/login.defs

  3. Verify user-specific settings from /etc/shadow:

    grep -E ^[^:]+:[^\!*] /etc/shadow | cut -d: -f1,4

  4. Open the configuration file:

    sudo nano /etc/login.defs

  5. Set the following parameter:

    PASS_MIN_DAYS 7

  6. Update existing users to comply with the policy:

    chage --mindays 7 <user>
  7. Repeat the above command for all users with valid passwords.
  8. Verify the changes by re-running the audit commands.
  9. Perform regular audits to ensure compliance with password policies.