Audit Linux password and login security settings
A checklist-driven review of password policy, PAM, account aging, and file permissions on Linux servers, with safe fixes.
The prompt
Help me audit password and login security settings on Linux systems I administer.
Distribution and version: [e.g. "Ubuntu 22.04", "RHEL 9"]
Standard to measure against: [e.g. "CIS Benchmark", "our internal policy", "NIST SP 800-63B"]
Config excerpts: [PASTE relevant lines from /etc/login.defs, /etc/security/pwquality.conf, /etc/pam.d/ files, /etc/ssh/sshd_config, and output of `ls -l /etc/passwd /etc/shadow /etc/group /etc/gshadow` - remove all hashes and real usernames first]
How accounts are managed: [local only / LDAP / SSO / mixed]
Check and report on:
1. Password quality: minimum length, complexity or banned-password rules, history and reuse prevention.
2. Password aging: max/min days and warning days, and whether they match my standard (note that NIST now discourages forced periodic changes without cause).
3. Hashing algorithm in use (e.g. yescrypt, SHA-512) and rounds.
4. Lockout after failed attempts (pam_faillock or equivalent) and unlock time.
5. File permissions and ownership on the account files.
6. SSH: root login, password vs key authentication, empty passwords.
7. Accounts with empty passwords, UID 0 other than root, or inactive accounts.
Return a findings table: Control | Current setting | Expected | Status (Pass / Fail / Unclear) | Risk | Fix (exact config line or command) | Test before rollout?
Then give a short audit script that only reads settings and changes nothing. Warn me before any fix that could lock users out (PAM and SSH changes), and recommend keeping a second session open while testing. Only run this on systems I am authorized to audit.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- e.g. "Ubuntu 22.04", "RHEL 9"
- local only / LDAP / SSO / mixed
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Analyze logs to find what went wrongReads logs to identify errors, patterns, and the likely root cause.
- Get a beginner-friendly code review of my first projectA ranked set of the five improvements that matter most, explained simply, plus what you did well and what to learn next.
- Turn a threat report into Sigma detection rulesExtracts behaviors from a threat report, maps them to MITRE ATT&CK, and writes tuned Sigma rules with test notes.
- Review every change since my last release before shippingA pre-release review of all changes since a tag: missing translations, simplifications, breaking changes, security, and a draft changelog.