TMAegisBeta
More rules for linux

Linux distributions

TMA-RHEL9-5.4.1.6

Ensure all users last password change date is in the past

MediumLevel 1Automatedlinux

Description

All users should have a password change date in the past.

How it is checked

Audit method: Shell command

shell
alt0() { o=$(bash -c '#!/usr/bin/env bash

{
 while IFS= read -r l_user; do
 l_change_raw=$(chage --list "$l_user" | grep '"'"'^Last password change'"'"' | cut - d: -f2 | tr -d '"'"' '"'"')
 [ "$l_change_raw" = "never" ] && continue
 l_change=$(date -u -d "$l_change_raw" +%s 2>/dev/null) || continue
 if [[ "$l_change" -gt "$(date +%s)" ]]; then
 echo "User: \"$l_user\" last password change was \"$l_change_raw\""
 fi
 done < <(awk -F: '"'"'$2~/^\$.+\$/{print $1}'"'"' /etc/shadow)
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi
Expected output
compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate. Examples Reset last change date to today for a single user: # chage -d "$(date +%Y-%m-%d)" <user> Force password change on next login (recommended companion): # chage -d 0 <user>

Properties

Operating systems
rhel-9
Tags
cis-convertedlinux
Reference
CIS Red Hat Enterprise Linux 9 Benchmark v3.0.0 - 5.4.1.6

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell
tmaegis scan --target linux