Audit Linux Password Policy: chage and pwquality

Updated: 2025-11-17

How to Check Password Policy Configuration in Security Au...

Configure automated checks to verify password policy settings on your Linux server? Need to ensure password policies are properly configured to enforce stro...

Why Password Policy Configuration Matters

Password policy configuration on your Linux server is critical for security and compliance. Weak password policies allow users to create easily guessable passwords, reuse old passwords, or never change passwords, increasing the risk of unauthorized access. Regular password policy audits help ensure strong authentication requirements, comply with security standards, prevent password-related attacks, and maintain system security.

Method 1: Check Password Policy with /etc/login.defs

The /etc/login.defs file contains system-wide password policy settings that apply to all users.

Check Password Policy Settings

To see current password policy:

# Check password policy settings
grep -E 'PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE' /etc/login.defs

# Show all password-related settings
grep -i pass /etc/login.defs

# Check specific policy values
grep -E '^PASS_MAX_DAYS|^PASS_MIN_DAYS|^PASS_MIN_LEN|^PASS_WARN_AGE' /etc/login.defs

Verify Policy Values

To verify policy values:

# Check maximum password age
grep ^PASS_MAX_DAYS /etc/login.defs

# Check minimum password length
grep ^PASS_MIN_LEN /etc/login.defs

# Check password warning age
grep ^PASS_WARN_AGE /etc/login.defs

Method 2: Check Password Policy with PAM Configuration

PAM (Pluggable Authentication Modules) can also enforce password policies. Check PAM configuration for additional password requirements.

Check PAM Password Policy

# Check PAM password configuration
cat /etc/pam.d/common-password

# Check for password complexity requirements
grep -i password /etc/pam.d/common-password

# Check password quality module
grep pam_pwquality /etc/pam.d/common-password

Check Password Quality Settings

# Check password quality configuration
cat /etc/security/pwquality.conf

# Check password complexity rules
grep -v '^#' /etc/security/pwquality.conf | grep -v '^$'

Method 3: Automated Password Policy Monitoring with Zuzia.app

Running these checks by hand works once. Zuzia's agent lets you repeat them on every server without logging in to each one.

How it works in Zuzia

Install the Zuzia agent on the server with one command.
Zuzia runs a basic security audit on the host and lists what it found. On paid plans, AI summarises the findings in plain language.
The agent collects system logs, so you can read them in the panel instead of over SSH.
Save the commands from this guide as a scheduled task and choose how often they run. If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account). On paid plans, AI can read the output and alert you only when it spots a problem.

Setting it up

Add the server in the Zuzia dashboard and install the agent.
Open the host's security audit and logs.
Create a scheduled task with the check commands below, choose the hosts and frequency, and pick your notification channels.

Method 4: Advanced Password Policy Monitoring Techniques

Check User Password Age

To check individual user password ages:

# Check password age for specific user
chage -l username

# Check password expiration date
chage -l username | grep "Password expires"

# List all users with password expiration
for user in $(cut -d: -f1 /etc/passwd); do echo "=== $user ==="; chage -l $user 2>/dev/null | grep "Password expires"; done

Verify Policy Compliance

To verify users comply with policy:

# Check users with passwords that never expire
awk -F: '$5 > 99999 {print $1}' /etc/passwd

# Check users with weak passwords (if using password quality)
grep -E "password.*minlen" /etc/security/pwquality.conf

Real-World Use Cases for Password Policy Monitoring

Security Compliance

For security compliance:

# Generate password policy report
grep -E 'PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE' /etc/login.defs > password-policy-$(date +%Y%m%d).txt

# Check PAM configuration
cat /etc/pam.d/common-password >> password-policy-$(date +%Y%m%d).txt

# Verify policy compliance
chage -l root >> password-policy-$(date +%Y%m%d).txt

Security Audit

For security audits:

# Check password policy settings
grep -E '^PASS' /etc/login.defs

# Check for weak policies
grep -E 'PASS_MAX_DAYS.*[0-9]{4,}|PASS_MIN_LEN.*[0-8]' /etc/login.defs

# Verify password quality module
grep pam_pwquality /etc/pam.d/common-password

Recommended Password Policy Settings

For strong password security:

# Edit /etc/login.defs
PASS_MAX_DAYS 90
PASS_MIN_DAYS 1
PASS_MIN_LEN 12
PASS_WARN_AGE 7

# Configure password quality (in /etc/security/pwquality.conf)
minlen = 12
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

Best Practices for Password Policy Monitoring

1. Monitor Password Policy Regularly

Check password policy weekly or monthly, or after security policy changes. Use Zuzia.app automated security audits to check policy compliance continuously without manual intervention.

2. Enforce Strong Policies

Use recommended settings: PASS_MAX_DAYS 90, PASS_MIN_LEN 12, PASS_WARN_AGE 7. These values balance security with usability.

3. Combine with PAM

Use both /etc/login.defs and PAM password quality module for comprehensive password policy enforcement.

4. Monitor User Compliance

Regularly check user password ages and expiration dates. Alert on users with passwords that never expire.

5. Document Policy Changes

Document all password policy changes and reasons. This helps with compliance audits and troubleshooting.

Troubleshooting Common Password Policy Issues

Policy Not Applied

If password policy is not being applied:

# Check /etc/login.defs syntax
grep -E '^PASS' /etc/login.defs

# Check PAM configuration
cat /etc/pam.d/common-password

# Verify password quality module
grep pam_pwquality /etc/pam.d/common-password

Users Not Complying

If users are not complying with policy:

# Check user password age
chage -l username

# Force password change
chage -d 0 username

# Check password expiration
chage -l username | grep "Password expires"

FAQ: Common Questions About Password Policy

Why is password policy important?

Password policies enforce strong passwords, prevent reuse, and ensure regular password changes, reducing the risk of unauthorized access. Weak password policies are a common security vulnerability that attackers exploit.

What are good password policy values?

Recommended values:

PASS_MAX_DAYS: 90 (force password change every 3 months)
PASS_MIN_LEN: 12 (minimum 12 characters)
PASS_WARN_AGE: 7 (warn 7 days before expiration)
PASS_MIN_DAYS: 1 (prevent immediate password changes)

How often should I check password policy?

This check is included in Zuzia.app security audits. Run audits weekly or monthly, or after security policy changes. Use automated monitoring to check policy compliance continuously.

How do I detect weak password policies?

Set up automated monitoring in Zuzia.app that checks password policy settings. Alert on policies with PASS_MAX_DAYS > 365, PASS_MIN_LEN < 8, or missing policy settings. Review audit results regularly.

Can I enforce password complexity requirements?

Yes, use PAM password quality module (pam_pwquality) to enforce complexity requirements like uppercase, lowercase, digits, and special characters. Configure in /etc/security/pwquality.conf.

How can I monitor password policy across multiple servers?

Zuzia.app allows you to add multiple servers and monitor password policy configuration across all of them simultaneously. Each server executes security audits independently, and all results are stored in Zuzia.app's database for centralized monitoring and analysis.

Does Zuzia.app use AI to analyze password policy compliance?

On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.