Ensure all users last password change date is in the past

How it is checked

Audit method: Shell command

[ -r /etc/shadow ] || exit 1; t=$(( $(date +%s) / 86400 )); awk -F: -v t=$t '$2 ~ /^[^*!xX]/ && $3 != "" && $3+0 > t {f=1} END{exit f}' /etc/shadow && echo compliant || echo noncompliant

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target cos