Skip to content

5.4.1.6 Ensure all users last password change date is in the past

Audit#

Run the following script and verify nothing is returned: 

1
2
3
4
5
6
7
8
9
#!/usr/bin/env bash
{
while IFS= read -r l_user; do
l_change=$(date -d "$(chage --list $l_user | grep '^Last password change' | cut -d: -f2 | grep -v 'never$')" +%s)
if [[ "$l_change" -gt "$(date +%s)" ]]; then
echo "User: \"$l_user\" last password change was \"$(chage --list $l_user | grep '^Last password change' | cut -d: -f2)\""
fi
done < <(awk -F: '$2~/^\$.+\$/{print $1}' /etc/shadow)
}

Remediation#

Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate.