Password Policies and Aging

# View the full shadow entry for a user (root only)
sudo getent shadow alice

# A cleaner way to view just the aging fields
sudo chage -l alice

# Apply a full aging policy to an account in one command
sudo chage -M 90 -m 1 -W 14 -I 7 alice

# Force a user to change their password at next login (common after account creation)
sudo chage -d 0 alice

# Set an account to expire on a specific date (useful for contractors)
sudo chage -E 2025-12-31 contractor1

# Remove an account expiry date (set to -1 or "never")
sudo chage -E -1 alice

# Use interactive mode — chage prompts for each field
sudo chage alice

# Apply the same aging policy to all users in a loop
for user in alice bob charlie; do
  sudo chage -M 90 -m 1 -W 14 -I 7 "$user"
  echo "Policy applied to $user"
done

# /etc/login.defs — relevant password aging settings

# Maximum number of days a password is valid
PASS_MAX_DAYS   90

# Minimum number of days between password changes
PASS_MIN_DAYS   1

# Number of days warning given before a password expires
PASS_WARN_AGE   14

# Minimum acceptable password length
PASS_MIN_LEN    12

# UID and GID ranges for regular users
UID_MIN         1000
UID_MAX         60000
GID_MIN         1000
GID_MAX         60000

# Whether to create a home directory by default with useradd
CREATE_HOME     yes

# View the current login.defs password settings
grep -E "^PASS" /etc/login.defs

# Edit login.defs (always back up first)
sudo cp /etc/login.defs /etc/login.defs.bak
sudo nano /etc/login.defs

# Verify a specific setting after editing
grep "PASS_MAX_DAYS" /etc/login.defs

# Install pwquality (Debian/Ubuntu)
sudo apt install libpam-pwquality -y

# Install pwquality (RHEL/Rocky)
sudo dnf install libpwquality -y

# /etc/security/pwquality.conf — password complexity rules

# Minimum password length
minlen = 12

# Require at least 1 uppercase letter (negative value = minimum required)
ucredit = -1

# Require at least 1 lowercase letter
lcredit = -1

# Require at least 1 digit
dcredit = -1

# Require at least 1 special character
ocredit = -1

# Reject if password contains the username
reject_username = 1

# Number of characters that must differ from the previous password
difok = 4

# Maximum number of identical consecutive characters allowed
maxrepeat = 3

# Test a password against the current pwquality rules without changing anything
pwscore <<< "mypassword123"

# View the PAM password stack for the passwd command
cat /etc/pam.d/passwd

# Check that pam_pwquality is loaded in the common-password PAM file (Debian/Ubuntu)
grep pwquality /etc/pam.d/common-password

# /etc/security/faillock.conf — account lockout policy

# Number of failed attempts before the account is locked
deny = 5

# Time window (seconds) in which failures are counted
fail_interval = 900

# How long (seconds) the account stays locked (0 = until admin unlocks)
unlock_time = 600

# Also lock the root account (use with caution on servers you can reach physically)
# even_deny_root

# Audit log all authentication failures
audit

# Check how many failed login attempts alice has
sudo faillock --user alice

# Unlock alice's account after a lockout
sudo faillock --user alice --reset

# View failed login attempts in the auth log (Debian/Ubuntu)
sudo grep "Failed password" /var/log/auth.log | tail -20

# View failed login attempts in the secure log (RHEL/Rocky)
sudo grep "Failed password" /var/log/secure | tail -20

# View who is currently locked out system-wide
sudo faillock

# List all regular users and their password expiry status
sudo awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd | \
  while read user; do
    echo "=== $user ==="
    sudo chage -l "$user" | grep -E "expires|Password"
  done

# Find accounts with passwords that never expire (MAX_DAYS = 99999 or -1)
sudo awk -F: '($5 == 99999 || $5 == -1) && $3 >= 1000 {print $1}' /etc/shadow

# Find accounts with no password set at all (empty hash field)
sudo awk -F: '($2 == "" || $2 == "!!" ) && $3 >= 1000 {print $1}' /etc/shadow

# Find accounts with expired passwords
sudo awk -F: '$3 >= 1000 {print $1}' /etc/passwd | \
  while read user; do
    expiry=$(sudo chage -l "$user" | grep "Password expires" | cut -d: -f2)
    echo "$user: $expiry"
  done