AUTH-9286 - Password aging
This information is provided as part of the Lynis community project. It is related to Lynis control AUTH-9286 and should be considered as-is and without guarantees. Any advice and commands should be tested before implementing them in production environments.
| Control details | |
|---|---|
| Category | Authentication |
| Application | |
Description
How to solve
Passwords are a key component to authenticate users to Linux systems. Passwords need to be of a good quality, to prevent so-called brute-forcing attacks. In such case, easy passwords can be quickly guessed, resulting in a possible intrusion. The strength of passwords is determined by the length and variety of characters, including capitals, numbers, and special characters.
Besides the strength, it is good to use password aging. This means a password can only be used for a specific duration of time before the user has to change it again. This enforces them to change it on a regular basis, having hopefully a bigger variety in passwords used on the system and other services.
Password aging is not always needed on the Linux system itself. For example, when using two-factor authentication, central authentication with LDAP or Radius.
For Lynis Enterprise users we have additional tests regarding authentication and passwords. Consider upgrading if password strength and aging are important aspects for your environment.
Need more details?
Consider the upgrade to Lynis Enterprise to receive additional details and guidance. The Enterprise version helps to you with daily health checks of your environment, learn in-depth system hardening, and resources to protect your systems better.
See demoAbout
Lynis is a technical security auditing tool for Unix flavors like Linux, macOS, AIX, Solaris, and *BSD. It is open source software and free to use. Typical usage include system hardening, compliance testing, and vulnerability scanning. The project has an active community, including development via GitHub.
Lynis Enterprise
Do you need to collect data from multiple systems or compliance reporting? Lynis Enterprise uses Lynis to collect the data and make your work easier.
Benefits: automate security audits, detailed reporting, compliance testing.
- Centralized management
- Improvement plan with priorities
- Reporting
- Dashboards
- Predefined policies
- Integration (API)
- Improvement snippets for tools like Ansible, Chef, Cfengine, Puppet, and SaltStack