cis-ubuntu1804-v220-4-5-1-5

name	cis-ubuntu1804-v220-4-5-1-5
description	Ensure all users last password change date is in the past
category	cis-iam
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","users","password-policy"]
cis_id	4.5.1.5
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.5.1.5

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

All users should have a password change date in the past.

Rationale

If a users recorded password change date is in the future then they could bypass any set password expiration.

Audit Procedure

Command Line

Run the following script to verify all users last password change was in the past:

#!/usr/bin/env bash
{
  l_output2=""
  while read -r l_user; do
    l_change="$(chage --list $l_user | awk -F: '($1 ~ /^\s*Last\s+password\s+change/ && $2 !~ /never/){print $2}' | xargs)"
    if [[ "$(date -d "$l_change" +%s)" -gt "$(date +%s)" ]]; then
      l_output2="$l_output2\n - User: \"$l_user\" last password change is in the future \"$l_change\""
    fi
  done < <(awk -F: '($2 ~ /^[^*!xX\n\r]/{print $1}' /etc/shadow)
  if [ -z "$l_output2" ]; then
    echo -e "\n- Audit Result:\n  ** PASS **\n - All user password changes are in the past \n"
  else
    echo -e "\n- Audit Result:\n  ** FAIL **\n - Reasons for audit failure :$l_output2\n"
  fi
}

Expected Result

** PASS ** - All user password changes are in the past

Remediation

Command Line