My group just requested a security scan on some of our development systems and were informed that a number of system type accounts were insecure because the password did not have a maximum time limit. The scan reported only those passwords that had the -M value set to 99999 and not those with -1. Is there a functional difference?

We also found that the scan reported accounts even if they had /sbin/nologin as their login shell. Why are these an issue?

  • "Qualys QID 105083 User accounts with Password Aging not set" is the tool and defect. A number of questions I found on various SE sites (SO and U&L) seemed to mostly suggest 99999, and this issue really made me wonder why? I don't have the docs - our Security department ran the scans for us. – Sinc May 10 '16 at 14:01
  • From the security perspective, does it make sense to complain about accounts that virtually don't expire and not about ones that literally never expire? Wouldn't both be of equal concern, and mostly only if they have a valid login shell? Is an account with no expiry but /sbin/nologin at risk? – Sinc May 10 '16 at 14:04

chage -M 99999: The password will be valid for 99999 days (until 21 feb 2290 if changed today)

chage -M -1: This will remove the checking of the password's validity.

So, unless your users are quite longlived (and are not going to change your systems passwords)… no, I don't see any functional difference ☺

That security scan doesn't seem too thorough.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.