cyberstrikeus Ensure all users last password change date is in the past
Profile Applicability:
- Level 1 - Server
- Level 1 - Workstation
Assessment Status: Automated
Description
All users should have a password change date in the past.
Rationale
If a users recorded password change date is in the future then they could bypass any set password expiration.
Audit Procedure
Command Line
Run the following command and verify nothing is returned:
awk -F : '/^[^:]+:[^!*]/{print $1}' /etc/shadow | while read -r usr; do [ "$(date --date="$(chage --list "$usr" | grep '^Last password change' | cut -d: -f2)" +%s)" -gt "$(date "+%s")" ] && echo "user: $usr password change date: $(chage --list "$usr" | grep '^Last password change' | cut -d: -f2)"; done
Expected Result:
Nothing should be returned.
Remediation
Command Line
Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate.
References
None
CIS Controls
| Controls Version | Control |
|---|---|
| v7 | 4.4 Use Unique Passwords - Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system. |
Profile
- Level 1 - Server
- Level 1 - Workstation