Eu percebi isso.
#!/bin/bash
set -x
grep -q 'PASS_WARN_AGE 7' /etc/login.defs
if [ ${?} -eq 0 ]; then
echo "RHEL-06-000054 not a finding"
grep -q 'PASS_WARN_AGE 0' /etc/login.defs
elif [ ${?} -eq 0 ]; then
sed -ie 's/PASS_WARN_AGE\s\s\s\s0/PASS_WARN_AGE 7/g' /etc/login.defs; echo "RHEL-06-000054 patched"
else echo "needs further review"
fi