Configuration conflict when using both chef-ssh-hardening and chef-os-hardening

[eric-chennells]

Describe the bug
chef-ssh-hardening disables ssh password authentication, but chef-os-hardening sets the password expiry to 60 days.

If a system has both of these applied, users will be using ssh key based authentication and may not have a local password set. In this case after 60 days they are unable to login because they are prompted to change their password which they don't have.

Expected behavior
If no password has been set it shouldn't expire.

OS / Environment

Ubuntu 18.04 LTS

[eric-chennells]

I did some further research and realized that if an account is created as a "system account" it won't have the password expiry set. It will however have a UID between 100 and 1000. I'm not sure what security consequences that might have.

[eric-chennells]

It seems like disabling the max age for the password (by setting the value to -1) is the solution, as outlined here #58