# Audit Linux password and login security settings

A checklist-driven review of password policy, PAM, account aging, and file permissions on Linux servers, with safe fixes.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/audit-linux-password-and-login-security-settings

## Prompt

```text
Help me audit password and login security settings on Linux systems I administer.

**Distribution and version:** [e.g. "Ubuntu 22.04", "RHEL 9"]
**Standard to measure against:** [e.g. "CIS Benchmark", "our internal policy", "NIST SP 800-63B"]
**Config excerpts:** [PASTE relevant lines from /etc/login.defs, /etc/security/pwquality.conf, /etc/pam.d/ files, /etc/ssh/sshd_config, and output of `ls -l /etc/passwd /etc/shadow /etc/group /etc/gshadow` - remove all hashes and real usernames first]
**How accounts are managed:** [local only / LDAP / SSO / mixed]

Check and report on:
1. Password quality: minimum length, complexity or banned-password rules, history and reuse prevention.
2. Password aging: max/min days and warning days, and whether they match my standard (note that NIST now discourages forced periodic changes without cause).
3. Hashing algorithm in use (e.g. yescrypt, SHA-512) and rounds.
4. Lockout after failed attempts (pam_faillock or equivalent) and unlock time.
5. File permissions and ownership on the account files.
6. SSH: root login, password vs key authentication, empty passwords.
7. Accounts with empty passwords, UID 0 other than root, or inactive accounts.

Return a findings table: Control | Current setting | Expected | Status (Pass / Fail / Unclear) | Risk | Fix (exact config line or command) | Test before rollout?

Then give a short audit script that only reads settings and changes nothing. Warn me before any fix that could lock users out (PAM and SSH changes), and recommend keeping a second session open while testing. Only run this on systems I am authorized to audit.
```

## What to fill in

- e.g. "Ubuntu 22.04", "RHEL 9"
- local only / LDAP / SSO / mixed

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.