Disables password expiration and inactivity policies

This was causing the kayobe and kolla service accounts to be locked
out of the system.

Author: jovial

etc/kayobe/inventory/group_vars/overcloud/cis

@@ -75,6 +75,12 @@ rhel9cis_max_log_file_size: 1024
 # `rhel9cis_bootloader_password_hash`
 rhel9cis_set_boot_pass: false
 
+# Disable account locking after inactivity period
+rhel9cis_inactivelock:
+    # This variable specifies the number of days of inactivity before an account will be locked.
+    # CIS requires a value of 30 days or less.
+    lock_days: 99999
+
 ##############################################################################
 # Ubuntu Jammy CIS Hardening Configuration
 
@@ -159,4 +165,24 @@ ubtu22cis_max_log_file_size: 1024
 # ubtu22cis_bootloader_password_hash
 ubtu22cis_rule_1_4_1: false
 ubtu22cis_rule_1_4_3: false
+
+# Disable password expiry by setting large values
+ubtu22cis_pass:
+    ## Control 5.5.1.2
+    # This variable governs after how many days a password expires.
+    # CIS requires a value of 365 or less.
+    max_days: 99999
+    ## Control 5.5.1.1
+    # This variable specifies the minimum number of days allowed between changing passwords.
+    # CIS requires a value of at least 1.
+    min_days: 0
+    ## Control 5.5.1.3
+    # This variable governs, how many days before a password expires, the user will be warned.
+    # CIS requires a value of at least 7.
+    warn_age: 7
+    ## Control 5.5.1.4
+    # This variable specifies the number of days of inactivity before an account will be locked.
+    # CIS requires a value of 30 days or less.
+    inactive: 99999
+
 ##############################################################################

releasenotes/notes/disable-password-expiry-3c296c72d36cd9da.yaml

@@ -0,0 +1,7 @@
+---
+critical:
+  - |
+    Disables password expiration and inactivity policies. This caused the kayobe
+    and kolla service accounts to be locked out of the system. You should re-apply
+    the CIS benchmark hardening playbook as soon as possible to avoid being locked
+    out of your system.