---
title: "HOST-PAM-006 Password Expiry Warning Too Short"
canonical: https://openvapt.com/checks/HOST-PAM-006.html
html: https://openvapt.com/checks/HOST-PAM-006.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-PAM-006 Password Expiry Warning Too Short

Reports whether users are warned at least 7 days before a password expires.

- Domain: Server
- Severity: Info
- Control category: Identity and Authentication
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N`
- CIS Controls v8: 5.2
- NIST CSF 2.0: PR.AA-01
- CWE: CWE-262
- OWASP Top 10 2021: A07:2021
- NIST SP 800-53 Rev. 5: IA-5(1)
- Benchmark topic: Password expiration warning days (CIS Controls v8 5.2) (topic only, no benchmark text)

## Why It Matters

Where passwords do expire, a short or missing warning means users are locked out without notice and support staff reset passwords under pressure, which is when weak temporary passwords and social engineering succeed. This is informational: with no expiry (HOST-PWD-005) the warning never fires.

## How It Detects

Reads PASS_WARN_AGE from /etc/login.defs; 7 or more passes. An unset value fails, because the built-in default does not meet the requirement. Skipped when the file does not exist; Incomplete when it cannot be read.

## How to Fix

Set  PASS_WARN_AGE 7  in /etc/login.defs, and for existing accounts  chage --warndays 7 <user> .

## How to Verify

```
grep '^PASS_WARN_AGE' /etc/login.defs
```

## Learn the Theory

- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [login.defs(5), Linux man-pages](https://man7.org/linux/man-pages/man5/login.defs.5.html)
- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go

Run it: `openvapt scan --only HOST-PAM-006`. Read it offline: `openvapt explain HOST-PAM-006`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-PAM-006.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.