umbermark-cli 1.0.0rc1__py3-none-any.whl

umbermark/checks/ssh_password_auth.py

@@ -0,0 +1,71 @@
+"""SSH: PasswordAuthentication should be `no` (keys only)."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.access import get_access_context, scale_for_reachability
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class SSHPasswordAuthCheck(Check):
+    id = "ssh_password_authentication"
+    title = "SSH password authentication disabled (keys only)"
+    category = "identity_auth"
+    severity = Severity.CRITICAL
+    weight = 16
+    remediation = (
+        "Disable password logins for SSH. IMPORTANT: sshd keeps the FIRST value it\n"
+        "reads for a keyword. /etc/ssh/sshd_config normally begins with\n"
+        "`Include /etc/ssh/sshd_config.d/*.conf`, so drop-ins are read first, in\n"
+        "lexical order, and a later `PasswordAuthentication no` in the main file\n"
+        "is ignored. Cloud images (cloud-init) ship\n"
+        "/etc/ssh/sshd_config.d/50-cloud-init.conf containing\n"
+        "`PasswordAuthentication yes`, which silently wins.\n"
+        "Fix: create a drop-in that sorts BEFORE it, e.g.\n"
+        "    /etc/ssh/sshd_config.d/01-hardening.conf:\n"
+        "        PasswordAuthentication no\n"
+        "        KbdInteractiveAuthentication no\n"
+        "(or edit/remove the offending drop-in; for cloud-init set\n"
+        "`ssh_pwauth: false` so it is not regenerated).\n"
+        "Verify the effective value with `sudo sshd -T | grep -i passwordauthentication`,\n"
+        "confirm a key login works from a second session, then reload sshd."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("sshd -T 2>/dev/null", sudo=True, timeout=10)
+        if r.ok and r.stdout:
+            m = re.search(r"^passwordauthentication\s+(\S+)", r.stdout, re.M | re.I)
+            if m:
+                value = m.group(1).lower()
+                if value == "yes":
+                    ctx = get_access_context(runner)
+                    sev, weight, note = scale_for_reachability(self.severity, self.weight, ctx)
+                    evidence = f"PasswordAuthentication = {value}"
+                    if ctx.ssh_password_sources:
+                        evidence += f" (set by: {'; '.join(ctx.ssh_password_sources[:3])})"
+                    if note:
+                        evidence += f". {note}"
+                    return self._finding(
+                        Verdict.FAIL, evidence=evidence, severity=sev, weight=weight
+                    )
+                ctx = get_access_context(runner)
+                if ctx.ssh_match_password:
+                    # `sshd -T` shows the non-Match value; a Match block re-enables passwords.
+                    crit, where = ctx.ssh_match_password[0]
+                    sev, weight, note = scale_for_reachability(self.severity, self.weight, ctx)
+                    evidence = (
+                        f"PasswordAuthentication = {value} globally, but password auth enabled for "
+                        f"Match {crit} ({where})"
+                    )
+                    if note:
+                        evidence += f". {note}"
+                    return self._finding(Verdict.WARN, evidence=evidence, severity=sev, weight=weight)
+                return self._finding(
+                    Verdict.PASS, evidence=f"PasswordAuthentication = {value}"
+                )
+
+        return self._finding(
+            Verdict.SKIP,
+            skip_reason="could not determine effective PasswordAuthentication (sshd -T failed)",
+        )

umbermark/checks/ssh_permit_root.py

@@ -0,0 +1,59 @@
+"""SSH: PermitRootLogin must not be `yes`."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class SSHPermitRootLoginCheck(Check):
+    id = "ssh_permit_root_login"
+    title = "SSH root login disabled"
+    category = "identity_auth"
+    severity = Severity.CRITICAL
+    weight = 18
+    remediation = (
+        "Disable root SSH login by setting in /etc/ssh/sshd_config (or a file "
+        "under sshd_config.d/):\n"
+        "    PermitRootLogin no\n"
+        "Then reload sshd: `sudo systemctl reload ssh` (Debian/Ubuntu) or "
+        "`sudo systemctl reload sshd` (RHEL-like)."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # Effective config dump (requires root)
+        r = runner.run("sshd -T 2>/dev/null", sudo=True, timeout=10)
+        if r.ok and r.stdout:
+            m = re.search(r"^permitrootlogin\s+(\S+)", r.stdout, re.M | re.I)
+            if m:
+                value = m.group(1).lower()
+                if value == "yes":
+                    return self._finding(Verdict.FAIL, evidence=f"PermitRootLogin = {value}")
+                return self._finding(Verdict.PASS, evidence=f"PermitRootLogin = {value}")
+
+        # Fallback: parse sshd_config (misses Include directives)
+        r2 = runner.run(
+            "grep -i '^[[:space:]]*PermitRootLogin' /etc/ssh/sshd_config 2>/dev/null"
+        )
+        if r2.ok and r2.stdout:
+            m2 = re.search(r"PermitRootLogin\s+(\S+)", r2.stdout, re.I)
+            if m2:
+                value = m2.group(1).lower()
+                if value == "yes":
+                    return self._finding(
+                        Verdict.FAIL,
+                        evidence=f"sshd_config: PermitRootLogin {value}",
+                    )
+                return self._finding(
+                    Verdict.WARN,
+                    evidence=(
+                        f"sshd_config: PermitRootLogin {value} "
+                        "(could not verify effective config; sshd -T requires root)"
+                    ),
+                )
+
+        return self._finding(
+            Verdict.SKIP,
+            skip_reason="could not determine effective PermitRootLogin (sshd -T failed and no explicit config line)",
+        )

umbermark/checks/ssh_weak_ciphers.py

@@ -0,0 +1,85 @@
+"""SSH: weak ciphers / MACs / KexAlgorithms must not be enabled."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.access import get_access_context, scale_for_reachability
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+# Weak crypto: OpenSSH's deprecation history + Mozilla guidance (2025+).
+_WEAK_CIPHERS = {
+    "3des-cbc", "blowfish-cbc", "cast128-cbc",
+    "arcfour", "arcfour128", "arcfour256",
+    "aes128-cbc", "aes192-cbc", "aes256-cbc",
+}
+_WEAK_MACS = {
+    "hmac-md5", "hmac-md5-96", "hmac-md5-etm@openssh.com",
+    "hmac-md5-96-etm@openssh.com",
+    "hmac-sha1-96", "hmac-sha1", "hmac-sha1-etm@openssh.com",
+    "hmac-sha1-96-etm@openssh.com",
+    "umac-64@openssh.com", "umac-64-etm@openssh.com",
+}
+_WEAK_KEX = {
+    "diffie-hellman-group1-sha1",
+    "diffie-hellman-group14-sha1",
+    "diffie-hellman-group-exchange-sha1",
+}
+
+
+def _parse_csv_value(text: str, key: str) -> list[str]:
+    m = re.search(rf"^{key}\s+(\S+)", text, re.M | re.I)
+    if not m:
+        return []
+    return m.group(1).split(",")
+
+
+class SSHWeakCiphersCheck(Check):
+    id = "ssh_weak_ciphers"
+    title = "SSH disallows weak ciphers / MACs / key exchange"
+    category = "identity_auth"
+    severity = Severity.HIGH
+    weight = 10
+    applicable_distros = ()
+    remediation = (
+        "Restrict SSH to strong crypto. In /etc/ssh/sshd_config:\n"
+        "    Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n"
+        "    MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com\n"
+        "    KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512\n"
+        "Then reload sshd."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("sshd -T 2>/dev/null", sudo=True, timeout=10)
+        if not r.ok or not r.stdout:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="could not run sshd -T (requires root and openssh-server)",
+            )
+        ciphers = set(_parse_csv_value(r.stdout, "ciphers"))
+        macs = set(_parse_csv_value(r.stdout, "macs"))
+        kex = set(_parse_csv_value(r.stdout, "kexalgorithms"))
+        bad_c = ciphers & _WEAK_CIPHERS
+        bad_m = macs & _WEAK_MACS
+        bad_k = kex & _WEAK_KEX
+        problems = []
+        if bad_c:
+            problems.append(f"weak ciphers: {','.join(sorted(bad_c))}")
+        if bad_m:
+            problems.append(f"weak MACs: {','.join(sorted(bad_m))}")
+        if bad_k:
+            problems.append(f"weak KEX: {','.join(sorted(bad_k))}")
+        if problems:
+            ctx = get_access_context(runner)
+            sev, weight, note = scale_for_reachability(self.severity, self.weight, ctx)
+            evidence = "; ".join(problems) + (f". {note}" if note else "")
+            return self._finding(Verdict.FAIL, evidence=evidence, severity=sev, weight=weight)
+        if not (ciphers or macs or kex):
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="sshd -T did not emit ciphers/macs/kexalgorithms lines",
+            )
+        return self._finding(
+            Verdict.PASS,
+            evidence=f"{len(ciphers)} ciphers, {len(macs)} MACs, {len(kex)} KEX — none weak",
+        )

umbermark/checks/sudo_requires_authentication.py

@@ -0,0 +1,41 @@
+"""sudo must ask for a credential: no pam_permit.so may be reachable after the real module fails.
+
+A PAM stack that permits unconditionally turns every local account that can run
+sudo into root with no authentication at all, regardless of sudoers. That includes a pam_permit reached once the real module
+fails (e.g. `sufficient pam_sss.so` followed by `sufficient pam_permit.so`). This reads
+the effective `auth` stack for sudo (following @include / include / substack),
+see core.access.classify_sudo_auth.
+"""
+from __future__ import annotations
+
+from umbermark.core.access import SudoAuth, get_access_context
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class SudoRequiresAuthenticationCheck(Check):
+    id = "sudo_requires_authentication"
+    title = "sudo requires authentication (PAM)"
+    category = "identity_auth"
+    severity = Severity.HIGH
+    weight = 12
+    applicable_distros = ()
+    remediation = (
+        "Make sure a failed authentication can never reach pam_permit.so in sudo's PAM auth stack:\n"
+        "  - delete any `auth sufficient pam_permit.so` or `auth [success=done ...] pam_permit.so`\n"
+        "    line from /etc/pam.d/sudo and the files it includes (common-auth / system-auth);\n"
+        "    a real module placed before it does not help, because a failing module just falls\n"
+        "    through to the permit;\n"
+        "  - if a trailing `auth required pam_permit.so` is needed (Debian's common-auth), put\n"
+        "    `auth requisite pam_deny.so` directly before it, after the real module, so a\n"
+        "    failed login stops there.\n"
+        "Debian: `pam-auth-update` regenerates /etc/pam.d/common-auth safely."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        ctx = get_access_context(runner)
+        if ctx.sudo_auth == SudoAuth.NONE:
+            return self._finding(Verdict.FAIL, evidence=f"sudo requires no authentication: {ctx.sudo_auth_note}")
+        if ctx.sudo_auth in (SudoAuth.LOCAL_PASSWORD, SudoAuth.DIRECTORY):
+            return self._finding(Verdict.PASS, evidence=ctx.sudo_auth_note)
+        return self._finding(Verdict.SKIP, skip_reason=f"sudo PAM stack undetermined ({ctx.sudo_auth_note})")

umbermark/checks/sudoers_nopasswd.py

@@ -0,0 +1,111 @@
+"""sudoers NOPASSWD audit — flags wide-scope passwordless sudo.
+
+Account-aware: NOPASSWD only matters if someone can reach the account.
+* shell is nologin/false, or the password is locked (no usable password):
+  the account can only get in with an SSH key, and passwordless sudo is then the
+  only way sudo can work at all. Ignored (noted in evidence).
+* account has a usable password: anyone who learns/guesses it gets root with
+  no second step -> flagged (medium, scaled down when SSH is not publicly
+  reachable).
+* groups (%sudo ...), directory/unknown users, or unreadable account data:
+  cannot be proven safe -> flagged as before (high when account data is
+  unavailable).
+"""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.access import get_access_context, scale_for_reachability
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+def _is_wide_scope(rule: str) -> bool:
+    """A NOPASSWD line is 'wide scope' if it grants ALL commands OR applies
+    to a privileged group (%sudo, %wheel, %admin)."""
+    # Whole-group NOPASSWD line
+    if re.match(r"^\s*%(sudo|wheel|admin|root)\b", rule):
+        return True
+    # NOPASSWD: ALL (any user/group with no command restriction)
+    if re.search(r"NOPASSWD\s*:\s*ALL\b", rule, re.I):
+        return True
+    return False
+
+
+class SudoersNopasswdCheck(Check):
+    id = "sudoers_nopasswd"
+    title = "sudoers NOPASSWD audit"
+    category = "identity_auth"
+    severity = Severity.HIGH
+    weight = 12
+    applicable_distros = ()
+    remediation = (
+        "Audit /etc/sudoers and /etc/sudoers.d/* for NOPASSWD entries.\n"
+        "Avoid blanket grants like:\n"
+        "    %wheel ALL=(ALL) NOPASSWD: ALL\n"
+        "Prefer narrow, command-specific grants:\n"
+        "    deploy ALL=(root) NOPASSWD: /usr/bin/systemctl reload nginx\n"
+        "Accounts that log in with a password should require it for sudo.\n"
+        "Edit only with `sudo visudo` (validates syntax before save)."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # -h strips the filename prefix so the parser doesn't have to.
+        r = runner.run(
+            "grep -rEh '^[[:space:]]*[^#].*NOPASSWD' /etc/sudoers /etc/sudoers.d/ 2>/dev/null",
+            sudo=True,
+            timeout=10,
+        )
+        if not r.ok and r.exit_code != 1:
+            # exit_code 1 from grep = "no matches" — that's a PASS, not an error
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason=f"grep over sudoers failed (exit {r.exit_code}); check requires root",
+            )
+        lines = [ln for ln in r.stdout.splitlines() if ln.strip()]
+        if not lines:
+            return self._finding(Verdict.PASS, evidence="no NOPASSWD entries in /etc/sudoers or /etc/sudoers.d/")
+        wide = [ln for ln in lines if _is_wide_scope(ln)]
+        if not wide:
+            return self._finding(
+                Verdict.WARN,
+                evidence=f"{len(lines)} narrow NOPASSWD rule(s) (specific commands, not blanket ALL)",
+            )
+
+        ctx = get_access_context(runner)
+        if not ctx.accounts_readable:
+            return self._finding(
+                Verdict.FAIL,
+                evidence=f"{len(wide)} wide-scope NOPASSWD rule(s): {'; '.join(wide[:3])}",
+            )
+
+        ignored: list[str] = []
+        flagged: list[str] = []
+        for ln in wide:
+            subject = ln.split()[0] if ln.split() else ""
+            acct = ctx.accounts.get(subject)
+            if acct is None or subject.startswith("%"):
+                flagged.append(ln)  # group, directory user or unknown: cannot prove safe
+            elif not acct.can_login or not acct.usable_password:
+                why = "no login shell" if not acct.can_login else "account locked"
+                ignored.append(f"{subject} (ignored: {why})")
+            else:
+                flagged.append(ln)
+        if not flagged:
+            return self._finding(
+                Verdict.PASS,
+                evidence=(
+                    f"{len(wide)} wide NOPASSWD rule(s) ignored: all for accounts without a usable password "
+                    f"or login shell, so sudo can only be reached with an SSH key: {', '.join(ignored)}"
+                ),
+            )
+        sev, weight, note = scale_for_reachability(Severity.MEDIUM, 6, ctx)
+        evidence = (
+            f"{len(flagged)} wide-scope NOPASSWD rule(s) for accounts with a usable password: "
+            f"{'; '.join(flagged[:3])}"
+        )
+        if ignored:
+            evidence += f" ({len(ignored)} rule(s) for locked/no-login accounts ignored)"
+        if note:
+            evidence += f". {note}"
+        return self._finding(Verdict.FAIL, evidence=evidence, severity=sev, weight=weight)

umbermark/checks/swap_pressure.py

@@ -0,0 +1,51 @@
+"""Sustained swap pressure — vmstat si/so columns."""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class SwapPressureCheck(Check):
+    id = "swap_pressure"
+    title = "No sustained swap pressure"
+    category = "services"
+    severity = Severity.LOW
+    weight = 2
+    applicable_distros = ()
+    remediation = (
+        "Find out what is using the memory and relieve it:\n"
+        "  - identify the memory-hungry process: ps aux --sort=-%mem | head\n"
+        "  - tune swappiness lower: sudo sysctl vm.swappiness=10\n"
+        "  - add RAM or shrink the workload\n"
+        "  - confirm /proc/meminfo SwapCached isn't masking healthy use"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("vmstat 1 3 2>/dev/null | tail -1", timeout=10)
+        if not r.ok or not r.stdout.strip():
+            return self._finding(
+                Verdict.SKIP, skip_reason="vmstat not available or returned no data"
+            )
+        cols = r.stdout.strip().split()
+        # vmstat columns: r b swpd free buff cache si so bi bo in cs us sy id wa st
+        # si is index 6, so is index 7
+        if len(cols) < 8:
+            return self._finding(
+                Verdict.SKIP, skip_reason=f"vmstat output unparseable: {r.stdout!r}"
+            )
+        try:
+            si = int(cols[6])
+            so = int(cols[7])
+        except ValueError:
+            return self._finding(
+                Verdict.SKIP, skip_reason=f"vmstat si/so non-numeric: {cols[6]!r}, {cols[7]!r}"
+            )
+        evidence = f"vmstat si={si}, so={so} (KB/sec)"
+        if si == 0 and so == 0:
+            return self._finding(Verdict.PASS, evidence=evidence)
+        if si < 100 and so < 100:
+            return self._finding(Verdict.WARN, evidence=evidence + " — low but non-zero")
+        return self._finding(
+            Verdict.FAIL,
+            evidence=evidence + " — sustained pressure (RAM exhausted?)",
+        )

umbermark/checks/time_sync.py

@@ -0,0 +1,55 @@
+"""Time sync — clock synchronized + NTP service active."""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class TimeSyncCheck(Check):
+    id = "time_sync"
+    title = "System clock is synced + NTP service is active"
+    category = "network"
+    severity = Severity.MEDIUM
+    weight = 5
+    applicable_distros = ()
+    remediation = (
+        "Ensure a time-sync daemon is running:\n"
+        "    sudo systemctl enable --now systemd-timesyncd   # default on most modern distros\n"
+        "    # OR for chrony:\n"
+        "    sudo apt install chrony && sudo systemctl enable --now chrony\n"
+        "Cert validation, log correlation, and many auth flows fail badly\n"
+        "with clock drift > a few minutes."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("timedatectl status 2>/dev/null", timeout=5)
+        if not r.ok or not r.stdout:
+            return self._finding(
+                Verdict.SKIP, skip_reason="timedatectl unavailable or returned nothing"
+            )
+        # Use exact equality — "inactive" contains "active" as a substring.
+        synced = self._line_value(r.stdout, "System clock synchronized") == "yes"
+        active = self._line_value(r.stdout, "NTP service") == "active"
+        if synced and active:
+            return self._finding(
+                Verdict.PASS, evidence="clock synced and NTP service active"
+            )
+        if synced and not active:
+            return self._finding(
+                Verdict.WARN,
+                evidence="clock synced but NTP service inactive (drift possible)",
+            )
+        return self._finding(
+            Verdict.FAIL,
+            evidence=(
+                "clock not synced"
+                + (" (NTP service active but failing)" if active else " (no NTP)")
+            ),
+        )
+
+    @staticmethod
+    def _line_value(text: str, key: str) -> str:
+        for line in text.splitlines():
+            if key in line:
+                return line.split(":", 1)[-1].strip().lower()
+        return ""

umbermark/checks/tmp_hardening.py

@@ -0,0 +1,45 @@
+"""/tmp mounted with noexec + nosuid options."""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class TmpHardeningCheck(Check):
+    id = "tmp_hardening"
+    title = "/tmp mounted with noexec + nosuid"
+    category = "filesystem"
+    severity = Severity.MEDIUM
+    weight = 4
+    applicable_distros = ()
+    remediation = (
+        "Mount /tmp with hardened options. In /etc/fstab:\n"
+        "    tmpfs   /tmp   tmpfs   defaults,noexec,nosuid,nodev,size=2G   0 0\n"
+        "Or for a disk-backed /tmp:\n"
+        "    UUID=... /tmp   ext4   defaults,noexec,nosuid,nodev   0 2\n"
+        "Then remount: sudo mount -o remount /tmp"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("findmnt /tmp -no OPTIONS 2>/dev/null", timeout=5)
+        if not r.ok or not r.stdout.strip():
+            return self._finding(
+                Verdict.WARN,
+                evidence="/tmp is not a separate mount (inherits root fs options — less hardening surface)",
+            )
+        opts = r.stdout.strip().split(",")
+        has_noexec = "noexec" in opts
+        has_nosuid = "nosuid" in opts
+        if has_noexec and has_nosuid:
+            return self._finding(
+                Verdict.PASS, evidence=f"/tmp options: {','.join(opts)}"
+            )
+        missing = []
+        if not has_noexec:
+            missing.append("noexec")
+        if not has_nosuid:
+            missing.append("nosuid")
+        return self._finding(
+            Verdict.WARN,
+            evidence=f"/tmp mounted but missing {', '.join(missing)} (current: {','.join(opts)})",
+        )

umbermark/checks/user_password_aging.py

@@ -0,0 +1,95 @@
+"""Accounts that can log in with a password but have no password-aging policy.
+
+Informational by design. NIST SP 800-63B section 5.1.1.2 advises verifiers
+AGAINST forcing periodic password changes (it drives weaker, predictable
+passwords); rotate on evidence of compromise instead. The check still reports
+usable-password accounts without a max age so operators who must satisfy a
+rotation policy (some compliance regimes) can see them. Locked accounts
+(`passwd -S` = L: shadow field starting `!` or `*`) cannot authenticate with a
+password and are ignored, as are accounts whose sudo/auth is delegated to a
+directory (the directory owns the password policy).
+"""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.access import SudoAuth, get_access_context
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+# Iterate shell-having users and dump chage info per user, prefixed so the
+# parser can attribute output back to a user.
+_CMD = (
+    "for u in $(awk -F: '$7 ~ /[/](bash|zsh|sh|dash|ksh|csh|tcsh|fish)$/ {print $1}' /etc/passwd); do "
+    "echo \"USER: $u\"; "
+    "chage -l \"$u\" 2>&1; "
+    "done"
+)
+
+
+class UserPasswordAgingCheck(Check):
+    id = "user_password_aging"
+    title = "User accounts have a password-aging policy (informational)"
+    category = "identity_auth"
+    severity = Severity.LOW
+    weight = 1
+    applicable_distros = ()
+    remediation = (
+        "Only set a maximum password age if a policy you must meet requires it. NIST SP 800-63B section 5.1.1.2 recommends AGAINST forced\n"
+        "periodic rotation; prefer SSH keys / MFA and change passwords on evidence\n"
+        "of compromise. To set one:\n"
+        "    sudo chage -M 90 <user>\n"
+        "or set system-wide defaults in /etc/login.defs (PASS_MAX_DAYS 90).\n"
+        "Accounts that do not need a password at all can be locked: `sudo passwd -l <user>`."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run(_CMD, sudo=True, timeout=15)
+        if not r.ok or not r.stdout:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="could not enumerate users (chage requires root)",
+            )
+        ctx = get_access_context(runner)
+        bad_users: list[str] = []
+        current_user: str | None = None
+        for line in r.stdout.splitlines():
+            mu = re.match(r"^USER:\s+(\S+)", line)
+            if mu:
+                current_user = mu.group(1)
+                continue
+            mm = re.search(
+                r"Maximum number of days between password change\s*:\s*(\S+)",
+                line,
+            )
+            if mm and current_user is not None:
+                value = mm.group(1)
+                if value in ("99999", "-1", "never"):
+                    bad_users.append(current_user)
+                current_user = None
+
+        if ctx.sudo_auth == SudoAuth.DIRECTORY:
+            return self._finding(
+                Verdict.PASS,
+                evidence=f"{ctx.sudo_auth_note}; the directory owns the password policy, local aging is not authoritative",
+            )
+        locked: list[str] = []
+        if ctx.accounts_readable:
+            usable = [u for u in bad_users if u not in ctx.accounts or ctx.accounts[u].usable_password]
+            locked = [u for u in bad_users if u not in usable]
+            bad_users = usable
+        if not bad_users:
+            extra = f" ({len(locked)} locked account(s) ignored)" if locked else ""
+            return self._finding(
+                Verdict.PASS,
+                evidence="all password-capable shell users have a password-max-days policy" + extra,
+            )
+        extra = f"; {len(locked)} locked account(s) ignored" if locked else ""
+        return self._finding(
+            Verdict.WARN,
+            evidence=(
+                f"{len(bad_users)} account(s) with a usable password and no max-password-age: "
+                f"{', '.join(bad_users[:5])}{extra}. Informational: NIST SP 800-63B 5.1.1.2 advises "
+                "against forced periodic rotation."
+            ),
+        )