# Ensure all users last password change date is in the past

Necessity: Setting a user's last password change date to a future date is a critical misconfiguration that undermines password expiration policies. It effectively extends the password's lifetime beyond what is defined in security policy (e.g., `PASS_MAX_DAYS` in `/etc/login.defs`), as the expiration counter starts from that future date. This could allow a compromised account to remain active for a longer, non-compliant period, increasing the window of opportunity for an attacker. Such a configuration is often an indicator of unauthorized or improper administrative action.

Auditing and Remediation: The audit script systematically scans the `/etc/shadow` file, which contains critical user password information. It specifically compares the third field for each user—the date of the last password change, stored as the number of days since the Unix epoch—against the current system date. A 'false' result indicates at least one account is misconfigured. The remediation script uses the standard `chage` utility, a safe and approved method for modifying user password aging information. It corrects the anomaly by resetting the last change date of any non-compliant account to the current day, thereby realigning the account with the established password expiration policy.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'true' (compliant). This is a binary control; there is no acceptable scenario or security level where a password change date should be set in the future. Any such occurrence is a direct violation of time-based security controls and must be corrected immediately. Therefore, regardless of the overall security posture, the only acceptable state is one where no user accounts have a future-dated password change.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['true']` |
| **Moderate** | `['true']` |
| **Strict** | `['true']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the last password change date for all non-system users in the `/etc/shadow` file. The script must parse field 3 (days since epoch) for each user and compare it to the current date (in days since epoch). If any user's last password change date is in the future, the script must return 'false'. Otherwise, it must return 'true'. The output must contain only the string 'true' or 'false'.

## Remediation Script Working

Bash script that identifies all non-system user accounts with a last password change date set in the future. For each identified account, the script must use the `chage` command to reset the last password change date to the current date. The script should not accept any arguments. It must return 'true' if it successfully corrects all affected accounts or if no corrections were needed, and 'false' if it encounters any errors.

