Linux distributions
TMA-ROCKY9-5.4.1.6
Ensure all users last password change date is in the past
MediumLevel 1Automatedlinux
Description
All users should have a password change date in the past.
How it is checked
Audit method: Shell command
shell
alt0() { o=$(bash -c '#!/usr/bin/env bash
{
while IFS= read -r l_user; do
l_change_raw=$(chage --list "$l_user" | grep '"'"'^Last password change'"'"' | cut - d: -f2 | tr -d '"'"' '"'"')
[ "$l_change_raw" = "never" ] && continue
l_change=$(date -u -d "$l_change_raw" +%s 2>/dev/null) || continue
if [[ "$l_change" -gt "$(date +%s)" ]]; then
echo "User: \"$l_user\" last password change was \"$l_change_raw\""
fi
done < <(awk -F: '"'"'$2~/^\$.+\$/{print $1}'"'"' /etc/shadow)
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate. Examples Reset last change date to today for a single user: # chage -d "$(date +%Y-%m-%d)" <user> Force password change on next login (recommended companion): # chage -d 0 <user>
Properties
- Operating systems
- rocky-9
- Tags
- cis-convertedlinux
- Reference
- CIS Rocky Linux 9 Benchmark v3.0.0 - 5.4.1.6
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target linux