How to Check Password Policy Configuration in Security Audit - Complete Guide

Are you wondering how to verify password policy settings on your Linux server? Need to ensure password policies are properly configured to enforce strong passwords and prevent weak authentication? This comprehensive guide shows you how to check password policy configuration, verify security settings, detect policy violations, and maintain authentication security on your Linux server.

Why Password Policy Configuration Matters

Password policy configuration on your Linux server is critical for security and compliance. Weak password policies allow users to create easily guessable passwords, reuse old passwords, or never change passwords, increasing the risk of unauthorized access. Regular password policy audits help ensure strong authentication requirements, comply with security standards, prevent password-related attacks, and maintain system security.

Method 1: Check Password Policy with /etc/login.defs

The /etc/login.defs file contains system-wide password policy settings that apply to all users.

Check Password Policy Settings

To see current password policy:

# Check password policy settings
grep -E 'PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE' /etc/login.defs

# Show all password-related settings
grep -i pass /etc/login.defs

# Check specific policy values
grep -E '^PASS_MAX_DAYS|^PASS_MIN_DAYS|^PASS_MIN_LEN|^PASS_WARN_AGE' /etc/login.defs

Verify Policy Values

To verify policy values:

# Check maximum password age
grep ^PASS_MAX_DAYS /etc/login.defs

# Check minimum password length
grep ^PASS_MIN_LEN /etc/login.defs

# Check password warning age
grep ^PASS_WARN_AGE /etc/login.defs

Method 2: Check Password Policy with PAM Configuration

PAM (Pluggable Authentication Modules) can also enforce password policies. Check PAM configuration for additional password requirements.

Check PAM Password Policy

# Check PAM password configuration
cat /etc/pam.d/common-password

# Check for password complexity requirements
grep -i password /etc/pam.d/common-password

# Check password quality module
grep pam_pwquality /etc/pam.d/common-password

Check Password Quality Settings

# Check password quality configuration
cat /etc/security/pwquality.conf

# Check password complexity rules
grep -v '^#' /etc/security/pwquality.conf | grep -v '^$'

Method 3: Automated Password Policy Monitoring with Zuzia.app

Manually checking password policy works for occasional audits, but for production servers, you need automated monitoring that alerts you when policy settings change. Zuzia.app provides comprehensive password policy monitoring through security audits.

Setting Up Automated Password Policy Monitoring

1. Enable Security Audit in Zuzia.app

   • Navigate to your server in Zuzia.app
   • Enable Security Audit feature
   • Password policy checks are automatically included in OS security audits

2. Configure Audit Schedule

   • Set audit frequency: Weekly or monthly
   • Configure alert conditions: Alert when password policy is missing or weak
   • Set up notifications for policy violations

3. Review Audit Results

   • Review audit results for password policy findings
   • Configure alerts when password policy is missing
   • Track policy changes over time

Security Checks Performed

Zuzia.app security audit checks for:

• PASS_MAX_DAYS (maximum password age)
• PASS_MIN_DAYS (minimum password age)
• PASS_MIN_LEN (minimum password length)
• PASS_WARN_AGE (password expiration warning)

Zuzia.app stores all audit results in its database, allowing you to track password policy compliance over time and identify security issues.

Method 4: Advanced Password Policy Monitoring Techniques

Check User Password Age

To check individual user password ages:

# Check password age for specific user
chage -l username

# Check password expiration date
chage -l username | grep "Password expires"

# List all users with password expiration
for user in $(cut -d: -f1 /etc/passwd); do echo "=== $user ==="; chage -l $user 2>/dev/null | grep "Password expires"; done

Verify Policy Compliance

To verify users comply with policy:

# Check users with passwords that never expire
awk -F: '$5 > 99999 {print $1}' /etc/passwd

# Check users with weak passwords (if using password quality)
grep -E "password.*minlen" /etc/security/pwquality.conf

Real-World Use Cases for Password Policy Monitoring

Security Compliance

For security compliance:

# Generate password policy report
grep -E 'PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE' /etc/login.defs > password-policy-$(date +%Y%m%d).txt

# Check PAM configuration
cat /etc/pam.d/common-password >> password-policy-$(date +%Y%m%d).txt

# Verify policy compliance
chage -l root >> password-policy-$(date +%Y%m%d).txt

Security Audit

For security audits:

# Check password policy settings
grep -E '^PASS' /etc/login.defs

# Check for weak policies
grep -E 'PASS_MAX_DAYS.*[0-9]{4,}|PASS_MIN_LEN.*[0-8]' /etc/login.defs

# Verify password quality module
grep pam_pwquality /etc/pam.d/common-password

Recommended Password Policy Settings

For strong password security:

# Edit /etc/login.defs
PASS_MAX_DAYS 90
PASS_MIN_DAYS 1
PASS_MIN_LEN 12
PASS_WARN_AGE 7

# Configure password quality (in /etc/security/pwquality.conf)
minlen = 12
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

Best Practices for Password Policy Monitoring

1. Monitor Password Policy Regularly

Check password policy weekly or monthly, or after security policy changes. Use Zuzia.app automated security audits to check policy compliance continuously without manual intervention.

2. Enforce Strong Policies

Use recommended settings: PASS_MAX_DAYS 90, PASS_MIN_LEN 12, PASS_WARN_AGE 7. These values balance security with usability.

3. Combine with PAM

Use both /etc/login.defs and PAM password quality module for comprehensive password policy enforcement.

4. Monitor User Compliance

Regularly check user password ages and expiration dates. Alert on users with passwords that never expire.

5. Document Policy Changes

Document all password policy changes and reasons. This helps with compliance audits and troubleshooting.

Troubleshooting Common Password Policy Issues

Policy Not Applied

If password policy is not being applied:

# Check /etc/login.defs syntax
grep -E '^PASS' /etc/login.defs

# Check PAM configuration
cat /etc/pam.d/common-password

# Verify password quality module
grep pam_pwquality /etc/pam.d/common-password

Users Not Complying

If users are not complying with policy:

# Check user password age
chage -l username

# Force password change
chage -d 0 username

# Check password expiration
chage -l username | grep "Password expires"

FAQ: Common Questions About Password Policy

Why is password policy important?

Password policies enforce strong passwords, prevent reuse, and ensure regular password changes, reducing the risk of unauthorized access. Weak password policies are a common security vulnerability that attackers exploit.

What are good password policy values?

Recommended values:

• PASS_MAX_DAYS: 90 (force password change every 3 months)
• PASS_MIN_LEN: 12 (minimum 12 characters)
• PASS_WARN_AGE: 7 (warn 7 days before expiration)
• PASS_MIN_DAYS: 1 (prevent immediate password changes)

How often should I check password policy?

This check is included in Zuzia.app security audits. Run audits weekly or monthly, or after security policy changes. Use automated monitoring to check policy compliance continuously.

How do I detect weak password policies?

Set up automated monitoring in Zuzia.app that checks password policy settings. Alert on policies with PASS_MAX_DAYS > 365, PASS_MIN_LEN < 8, or missing policy settings. Review audit results regularly.

Can I enforce password complexity requirements?

Yes, use PAM password quality module (pam_pwquality) to enforce complexity requirements like uppercase, lowercase, digits, and special characters. Configure in /etc/security/pwquality.conf.

How can I monitor password policy across multiple servers?

Zuzia.app allows you to add multiple servers and monitor password policy configuration across all of them simultaneously. Each server executes security audits independently, and all results are stored in Zuzia.app's database for centralized monitoring and analysis.

Does Zuzia.app use AI to analyze password policy compliance?

Yes, if you have Zuzia.app's full package, AI analysis is enabled. The AI can detect patterns in password policy compliance, identify security risks, predict potential authentication issues, and suggest security improvements based on historical password policy data and machine learning algorithms.