Servers – Ensure Password Expiration Warning Days is 7 or More

Support > Fixing Checks > Server

06 March, 2026

This check ensures that password expiration warning days are set to 7 or more.

The PASS_WARN_AGE parameter defines how many days in advance users are warned before their password expires. Setting this value to at least 7 days helps users prepare secure password updates and reduces risky behavior.

Check Details

Resource: Server
Check: Ensure password expiration warning days is 7 or more
Risk: Users may create weak passwords or unsafe practices if they are not warned in advance.

Remediation Steps

Open a terminal session on the server with root or sudo privileges.
Check the current value of PASS_WARN_AGE:
```
grep PASS_WARN_AGE /etc/login.defs
```
Verify all users' warning days before password expiration:
```
grep -E ^[^:]+:[^\!*] /etc/shadow | cut -d: -f1,6
```
Open the configuration file for editing:
```
sudo nano /etc/login.defs
```
Set the following parameter to 7 or more:
```
PASS_WARN_AGE 7
```
Update existing users to ensure compliance:
```
sudo chage --warndays 7 <username>
```
Verify that the changes have been applied successfully by re-running the audit commands.
Perform regular audits to ensure all users remain compliant with password policies.

Other Articles

Servers – Ensure Password Expiration Warning Days is 7 or More

Check Details

Remediation Steps