Unit 5 · Passwords and Policy · Lesson 12 of 25
Password Rules
The file that decides how long a password may live, and how to change it.
Making passwords expire
One file, three lines in it.
sudo nano /etc/login.defs
Press Ctrl+W to search, type PASS_MAX, and press Enter. That jumps you straight to the block you want:
Ubuntu ships PASS_MAX_DAYS at 99999, which is about 273 years. That counts as never expiring, and it is a finding on any hardened image.
Change the numbers, then Ctrl+O, Enter, Ctrl+X.
Why a minimum of 1 day
It looks like it gets in the way of good behavior. The reason is that many systems also refuse to let you reuse your last few passwords:
minimum 0 days: change it five times in twenty seconds,
then set the original one again
minimum 1 day: the same trick now takes five days
Try it yourself
sudo nano /etc/login.defs # Ctrl+W, search PASS_MAX, fix the three numbers
Do this lesson for real
With a free account you get the terminal, the challenges and the checks that go with every lesson in CyberPatriot Linux: Tokyo Jujutsu High, and your progress is saved as you go. CyberAcad is a 501(c)(3) nonprofit, so there is nothing to pay.