Cis Ubuntu1604 V200 5 5 1 2

Ensure password expiration is 365 days or less

Profile Applicability:

• Level 1 - Server
• Level 1 - Workstation

Assessment Status: Automated

Description

The PASS_MAX_DAYS parameter in /etc/login.defs allows an administrator to force passwords to expire once they reach a defined age.

Rationale

The window of opportunity for an attacker to leverage compromised credentials or successfully compromise credentials via an online brute force attack is limited by the age of the password. Therefore, reducing the maximum age of a password also reduces an attacker's window of opportunity. It is recommended that the PASS_MAX_DAYS parameter does not exceed 365 days and is greater than the value of PASS_MIN_DAYS.

Audit Procedure

Command Line

Run the following command and verify PASS_MAX_DAYS conforms to site policy, does not exceed 365 days, and is greater than PASS_MIN_DAYS:

grep PASS_MAX_DAYS /etc/login.defs

Expected output:

PASS_MAX_DAYS 365

Run the following command and Review list of users and PASS_MAX_DAYS to verify that all users' PASS_MAX_DAYS conforms to site policy, does not exceed 365 days, and is no less than PASS_MIN_DAYS:

awk -F: '(/^[^:]+:[^!*]/ && ($5>365 || $5~/([0-1]|-1|\s*)/)){print $1 " " $5}' /etc/shadow

Expected Result:

No <user>:<PASS_MAX_DAYS> should be returned.

Remediation

Command Line

Set the PASS_MAX_DAYS parameter to conform to site policy in /etc/login.defs:

PASS_MAX_DAYS 365

Modify user parameters for all users with a password set to match:

chage --maxdays 365 <user>

Default Value

PASS_MAX_DAYS 99999

References

1. https://www.cisecurity.org/white-papers/cis-password-policy-guide/

Additional Information

A value of -1 will disable password expiration.

The password expiration must be greater than the minimum days between password changes or users will be unable to change their password.

CIS Controls

Profile

• Level 1 - Server
• Level 1 - Workstation