User request: "what about checking for recent password changes, or users
created, or like password or group file updates"
NEW FEATURES:
1. check_recent_password_changes()
- Tracks password changes in last 7 days (using /etc/shadow)
- Shows which accounts had passwords changed
- Higher risk if root password changed recently
- Detects recently unlocked accounts
2. check_recent_user_changes()
- Detects users created in last 7 days (based on UID sequence + home dir age)
- Shows user age in days
- Tracks sudo/wheel group membership changes
- Flags if sudo group modified in last 24 hours
3. Enhanced system file tampering detection:
- Added /etc/group modification tracking
- Added /etc/gshadow modification tracking
- Shows exact hours since modification (not just "recently")
- Tracks: /etc/passwd, /etc/shadow, /etc/group, /etc/gshadow
4. Root password status display (ALWAYS shown):
- Shows last root password change date
- Shows days since last change
- Warns if changed TODAY or within 7 days
- Warns if not changed in over a year
- Example: "Last password change: 2025-12-13 (52 days ago)"
DETECTION EXAMPLES:
If password changed recently:
⚠️ Recent-Password-Changes: 3-accounts
Changed-passwords: user1,user2,root
Risk: +35 (root) or +15 (other users)
If users created recently:
⚠️ Recently-Created-Users: testuser(2d) hacker(5d)
Risk: +25
If sudo group modified:
⚠️ Sudo-Group-Modified-Recently: members=root,admin,newuser
Risk: +30
If system files modified:
⚠️ /etc/passwd-Modified-5h-ago
⚠️ /etc/shadow-Modified-5h-ago
⚠️ /etc/group-Modified-3h-ago
Total Checks: 9 → 11 comprehensive integrity checks
- Added: Password changes
- Added: User/group changes
- Enhanced: System file tampering (now tracks 4 files + timestamps)
Output Enhancement:
- Root password age always displayed at top of compromise detection
- Clear warnings for suspicious timing (changed today, changed recently)
- Detailed findings show WHO changed and WHEN
Impact:
- Can now detect privilege escalation via user creation
- Can detect password changes during attack
- Can detect group membership manipulation
- Shows full audit trail of account changes
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
cschantz
a0b3523d41