# Ensure all users last password change date is in the past

Necessity: Setting a user's last password change date to a future date is a logical inconsistency that can break critical account security policies. It can prevent password expiration rules from being enforced correctly, potentially allowing a password to exist indefinitely, which circumvents policies designed to ensure regular password rotation. This misconfiguration, whether accidental or malicious, creates a security vulnerability by undermining password lifecycle management.

Auditing and Remediation: The audit script examines the third field of each entry in the `/etc/shadow` file, which records the last password change as the number of days since the 1970-01-01 epoch. It compares this value to the current date, also calculated in days since the epoch, and reports any usernames whose date is in the future. The remediation script finds these same non-compliant accounts and uses the `chage -d today <username>` command to reset the last password change date to the current day, thereby correcting the logical error and ensuring password aging policies can function as intended.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is an empty string, signifying that the audit script found no users with a future-dated password change. This is a binary compliance issue; a user's password change date must be in the past. There are no degrees of acceptability for this setting. Any deviation from this represents a security misconfiguration that must be corrected immediately, regardless of the overall security posture of the system. Therefore, the only secure and valid state is full compliance.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['']` |
| **Moderate** | `['']` |
| **Strict** | `['']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/shadow` file. The script must calculate the current date in days since the epoch. For each user account, it will compare the last password change date (field 3) with the current date. It must output a single, comma-separated string of usernames for all accounts where the last change date is in the future. If no such accounts exist, it must output an empty string.

## Remediation Script Working

Bash script that identifies all user accounts in `/etc/shadow` with a last password change date set in the future. For each non-compliant user found, the script must execute the `chage -d today <username>` command to reset the date. The script does not need to process any command-line arguments. It must return `true` on successful completion (even if no changes were needed) and `false` if any command fails.

