Calculate password expiration date from chage aging policy settings like PASS_MAX_DAYS.
Linux password aging (configured system-wide in /etc/login.defs as PASS_MAX_DAYS/PASS_WARN_DAYS, or per-user via `chage`) forces periodic password rotation by tracking the last change date in /etc/shadow. The number of days remaining is simply the maximum lifetime minus how many days have already elapsed since the last change; once that goes to zero or negative the account is treated as expired, and PAM will prompt (or block, depending on PASS_INACTIVE) the user to set a new password at their next login attempt.
Days remaining
days_remaining = PASS_MAX_DAYS − (today − last_change_date)
`chage -l <username>` (as root) shows last change date, expiry date, and warning period. Non-root users can run `chage -l $(whoami)` to see their own aging info.
PASS_MAX_DAYS is when the password itself expires and must be changed. PASS_INACTIVE is a grace period (in days) after expiry during which the user can still log in only to change the password; once PASS_INACTIVE also elapses, the account is locked entirely until an administrator intervenes.
No — /etc/login.defs values are only applied to newly created accounts. To change aging policy for an existing user, use `chage -M <days> <username>` directly, which updates the relevant field in /etc/shadow for that account.