Detections
Analytics

5.4.1.6 Ensure all users last password change date is in the past

Information

All users should have a password change date in the past.

If a user's recorded password change date is in the future, then they could bypass any set password expiration. The shadow password suite calculates password expiry relative to the last password change date, so an account with a far-future last-change date can permanently bypass password expiration policies: the password never expires regardless of PASS_MAX_DAYS.

Solution

Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate.

Examples

Reset last change date to today for a single user:

# chage -d "$(date +%Y-%m-%d)" <user>

Force password change on next login (recommended companion):

# chage -d 0 <user>

Impact:

Correcting a user's last password change date to a valid past date may immediately subject the account to the configured PASS_MAX_DAYS expiration. If the corrected date already exceeds the maximum password age, the user may be forced to change the password at next login.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5

Plugin: Unix

Control ID: 0367df1777e029583c8d6e68cff516698cdf08a86353a47a88475c9980ed0c78