linuxexpert-practice-labs/labs/linux-plus/3-4-1-account-hardening/README.md

Linux+ 3.4.1: Hardening accounts

Password aging, password quality, locking and expiring an account, and auditing the accounts of a system.

Before you start

User hardtest doesn't exist yet: you create it. The lab has also added two accounts that an audit should catch. Write answers to the files in /root/lab-answers/.

Tasks

1. Read the current rules in pwquality.conf, login.defs and faillock.conf. Create user hardtest, and set its password aging: at most 90 days, at least 1 day, a warning 7 days before. Then make it change its password at the next login.
2. Ubuntu: install libpam-pwquality, so that passwd judges new passwords. Try passwd hardtest with the password password1 (Ctrl+C to stop). On the RHEL family, passwd uses pwquality already: just try it.
3. Lock hardtest's password and expire the account, and look at its shadow entry and chage -l.
4. Audit the system: find the accounts other than root with UID 0, and the accounts with an empty password. Write their names, one per line, to /root/lab-answers/4.

Hints

• useradd -m, chage -M -m -W, chage -d 0, chage -l.
• /etc/pam.d/common-password.
• passwd -l, chage -E 0, grep hardtest /etc/shadow.
• awk -F: '$3 == 0' /etc/passwd, awk -F: '$2 == ""' /etc/shadow, lastlog -b 30.