Check Details

• Resource: Server
• Check: Ensure all users last password change date is in the past
• Risk: Future password change dates can allow users to bypass password expiration controls.

Remediation Steps

1. Open a terminal session on the server with root or sudo privileges.

2. Run the following audit command to check for users with password change dates set in the future:

   

   for usr in $(cut -d: -f1 /etc/shadow); do 
     [[ $(chage --list $usr | grep '^Last password change' | cut -d: -f2) > $(date) ]] && 
     echo "$usr :$(chage --list $usr | grep '^Last password change' | cut -d: -f2)";
   done
   

3. Review the output. If no output is returned, all users are compliant.
4. For any users listed, investigate why the password change date is set in the future.

5. Apply one of the following remediation actions as appropriate:

   • Lock the user account
   • Expire the user password
   • Reset the user password manually

6. To expire a user password immediately, use:

   

   sudo chage -d 0 <username>
   

7. Re-run the audit command to confirm that no users have password change dates in the future.
8. Perform regular audits to ensure ongoing compliance with password policies.