Ubuntu Security · 4.2

🔑 Password Policy & Account Security

Enforce strong passwords and disable dangerous accounts⏱ ~4 min

All values below match CIS Ubuntu Linux 22.04 LTS Benchmark v1.0, Level 1. These are the authoritative settings for competition — not generic suggestions.

Password Age Policy: /etc/login.defs (CIS Level 1)

Variable	CIS Level 1 Value	What It Controls
PASS_MAX_DAYS	60 (CIS allows up to 365; 60 is recommended)	Maximum days before a password must be changed
PASS_MIN_DAYS	1 or more	Minimum days before a password can be changed again (prevents cycling through history)
PASS_WARN_AGE	7 or more	Days of advance warning before expiration

bash

sudo nano /etc/login.defs
 
# CIS Ubuntu 22.04 Level 1 values:
PASS_MAX_DAYS    60
PASS_MIN_DAYS    1
PASS_WARN_AGE    7
 
# Note: PASS_MIN_LEN in login.defs is overridden when pam_pwquality
# is active. Set password length in /etc/security/pwquality.conf instead.

Password Complexity & Length: pam_pwquality (CIS Level 1)

CIS Ubuntu 22.04 Level 1 requires libpam-pwquality to be installed and configured. The minimum password length per CIS is 14 characters — identical to the Windows CIS benchmark.

bash

# Install if not present
sudo apt install libpam-pwquality
 
# Edit the configuration
sudo nano /etc/security/pwquality.conf
 
# CIS Ubuntu 22.04 Level 1 required settings:
minlen = 14          # minimum 14 characters (CIS Level 1 requirement)
minclass = 4         # require all 4 character classes
dcredit = -1         # at least 1 digit
ucredit = -1         # at least 1 uppercase letter
lcredit = -1         # at least 1 lowercase letter
ocredit = -1         # at least 1 special character
maxrepeat = 3        # no more than 3 consecutive identical characters
maxsequence = 4      # reject predictable sequences like 'abcd' or '1234'

Password History: pam_pwhistory (CIS Level 1: 24 or more)

bash

sudo nano /etc/pam.d/common-password
 
# Add or update this line (CIS: remember 24 or more passwords):
password required pam_pwhistory.so remember=24 enforce_for_root
 
# enforce_for_root applies the rule even when root changes a user's password

Disable the Guest Account

bash

# For Ubuntu using LightDM (older Ubuntu 16/18)
sudo nano /etc/lightdm/lightdm.conf
# Add under [Seat:*]:
allow-guest=false
 
# For Ubuntu 20+/22+ using GDM3:
# Guest accounts are disabled by default in modern Ubuntu
# Verify with: sudo cat /etc/gdm3/custom.conf

Lock & Disable Accounts

bash

# Lock an account (prevent login, keeps the account)
sudo passwd -l alice
 
# Unlock an account
sudo passwd -u alice
 
# Set account expiry (disable after a date)
sudo usermod --expiredate '2025-01-01' alice
 
# Expire a password immediately (force change at next login)
sudo passwd --expire alice
 
# Check account status
sudo passwd -S alice

💡 TipIn competition, unauthorized accounts that can't simply be deleted (because the scenario says 'do not delete system accounts') should be locked with passwd -l and have their shell set to /sbin/nologin.

🧠Quick Checkfirst try = +5 XP

Where do you set minimum password length on Ubuntu (CIS)?

🎮 Practice what you learned

🏰

Password Fort

Build passwords that survive a brute-force siege

→🕵️

Log Analysis

Hunt attackers through real firewall & access logs

→

⭐ 0 XP🔥 0 days

Open the full interactive CyberPatriot Prep module →