TMAegisBeta
更多 linux 規則

Linux distributions

TMA-ROCKY9-5.4.1.6

Ensure all users last password change date is in the past

中等級 1自動化linux

說明

All users should have a password change date in the past.

檢查方式

稽核方法: Shell 指令

shell
alt0() { o=$(bash -c '#!/usr/bin/env bash

{
 while IFS= read -r l_user; do
 l_change_raw=$(chage --list "$l_user" | grep '"'"'^Last password change'"'"' | cut - d: -f2 | tr -d '"'"' '"'"')
 [ "$l_change_raw" = "never" ] && continue
 l_change=$(date -u -d "$l_change_raw" +%s 2>/dev/null) || continue
 if [[ "$l_change" -gt "$(date +%s)" ]]; then
 echo "User: \"$l_user\" last password change was \"$l_change_raw\""
 fi
 done < <(awk -F: '"'"'$2~/^\$.+\$/{print $1}'"'"' /etc/shadow)
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi
預期輸出
compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate. Examples Reset last change date to today for a single user: # chage -d "$(date +%Y-%m-%d)" <user> Force password change on next login (recommended companion): # chage -d 0 <user>

屬性

作業系統
rocky-9
標籤
cis-convertedlinux
參考資料
CIS Rocky Linux 9 Benchmark v3.0.0 - 5.4.1.6

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell
tmaegis scan --target linux