Profile My skills Saved Collections Edit profile Submit a skill

CIS Ubuntu 14.04 LTS - 5.4.1.5 Ensure all users last password change date is in the past

Verify no users have a password change date set in the future which could bypass expiration

cyberstrikeus Updated
Coding & Dev Tools

File contents

5.4.1.5 Ensure all users last password change date is in the past (Scored)

Profile Applicability

  • Level 1 - Server
  • Level 1 - Workstation

Description

All users should have a password change date in the past.

Rationale

If a users recorded password change date is in the future then they could bypass any set password expiration.

Audit Procedure

Verify no users with a have Password change date in the future:

cat /etc/shadow | cut -d: -f1
chage --list <user>

Expected Result

Last Change                                             : <date in the past>

Remediation

Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate.

Default Value

Password change date is set to current date when password is changed.

References

  • CIS Controls: 16 - Account Monitoring and Control

Profile

  • Level 1 - Server
  • Level 1 - Workstation

cyberstrikeus/cyberstrike/tree/main/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-14-04-lts-benchmark-v2/cis-ubuntu1404-v210-5-4-1-5 commit 59c5d61cd3

Browse category

Frequently asked questions

npx skillmds@latest add cyberstrikeus/cis-ubuntu-14-04-lts-5-4-1-5-ensure-all-users-last-password-