The PASS_WARN_AGE parameter in /etc/login.defs allows an administrator to notify users that their password will expire in a defined number of days. It is recommended that the PASS_WARN_AGE parameter be set to 7 or more days.
Rationale:
Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may choose a simple password or write it down where it may be discovered.
[7 days]
Set the PASS_WARN_AGE parameter to 7 in /etc/login.defs:
PASS_WARN_AGE 7
Modify active user parameters to match:
# chage -warndays 7 <user>
oval:org.secpod.oval:def:51249
SCAP Repo OVAL Definition
2019-04-16