My group just requested a security scan on some of our development systems and were informed that a number of system type accounts were insecure because the password did not have a maximum time limit. The scan reported only those passwords that had the -M value set to 99999 and not those with -1. Is there a functional difference?
We also found that the scan reported accounts even if they had
/sbin/nologin as their login shell. Why are these an issue?