PCI DSS [LWN.net]

PCI DSS

Posted Aug 13, 2026 8:21 UTC (Thu) by XTerminator (subscriber, #59581)
Parent article: Changes in shadow-utils password-expiration features

Nobody mentioned PCI DSS, and of course my intention is not to start a 'this xyz standard also' but regardless of what some other standards institutes have found, or it being secure or not secure, as a company taking card payments we have to comply with PCI DSS standards and are frequently audited (at least once a year)....

So if shadow-utils won't provide these time based expiry anymore our company and probably 10 million billion other companies will start to do their own password timeout and rotation scripts

Or, I may just fork the shadow-utils

either way, just another pain in the proverbial rear passage, that with the ever reducing max age of certificates that can't be managed through automation :-(

to post comments

PCI DSS

Posted Aug 13, 2026 9:37 UTC (Thu) by alx.manpages (subscriber, #145117) [Link]

For now, periodic password expiry is still supported; only deprecated.

The first removal only removed minimum password age, which AFAIK, no regulation mandates. IIRC, I did check PCI DSS some time ago, and it doesn't mandate it, right?

Auditors may complain about the lack of minimum password age, since that allows users to workaround password expiration policies, but you should complain to auditors saying that not allowing changing a password immediately is itself a security problem: if someone sees you while typing the new password, you should immediately change it (even if the age of that password is effectively 10 seconds), and you should also complain that the regulation doesn't require that. If the auditor doesn't recognize the security problem of not allowing 0-day password changes, you should report the incompetence of the auditor to the regulator.

Once that happens, please come to shadow-utils, and let us know the result of that litigation.

You would also do well pointing to this removal (and the deprecations that will be eventually removed in the future) to the authors of PCI-DSS, so that they decide whether they still believe in periodic password expiry or they want to accept it's bad.

If regulators are open to talk about removing this, and they need X years (such as maybe 5), we're open to slowing down on the removal, to reduce the friction.

If regulators on the other hand ignore this and refuse to talk, we're going to unilaterally remove this, eventually.

Also, we're not going to start conversations with every regulator. I tried to start conversations with the only regulator I know in my country. But users affected by other regulators (e.g., you by PCI-DSS) should talk to them. Please point them to this publication, and to the shadow-utils release notes.