fix(shadow-utils): configure CIS account aging defaults - #18652
Open
Lynsey Rydberg (corvus-callidus) wants to merge 1 commit into
Open
fix(shadow-utils): configure CIS account aging defaults#18652Lynsey Rydberg (corvus-callidus) wants to merge 1 commit into
Lynsey Rydberg (corvus-callidus) wants to merge 1 commit into
Conversation
Copilot started reviewing on behalf of
Lynsey Rydberg (corvus-callidus)
August 28, 2026 19:32
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Configures CIS-compliant account-aging defaults for newly created local accounts.
Changes:
- Sets password lifetime to 365 days and inactivity lockout to 30 days.
- Adds the corresponding shadow-utils overlay and refreshed generated state.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
base/comps/components.toml |
Wires in the shadow-utils overlay. |
base/comps/shadow-utils/overlays/0001-configure-cis-account-aging.toml |
Defines account-aging configuration overlays. |
locks/shadow-utils.lock |
Refreshes the component fingerprint. |
specs/s/shadow-utils/shadow-utils.login.defs |
Sets maximum password age. |
specs/s/shadow-utils/shadow-utils.spec |
Bumps the rendered package release. |
specs/s/shadow-utils/shadow-utils.useradd |
Sets the inactivity grace period. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Lynsey Rydberg (corvus-callidus)
force-pushed
the
lyrydber/cis-account-defaults
branch
from
August 28, 2026 20:24
9f3e4a5 to
1ae2cae
Compare
Copilot started reviewing on behalf of
Lynsey Rydberg (corvus-callidus)
August 28, 2026 20:25
View session
Set 365-day password expiration and a 30-day inactive-account lock for newly created accounts.
Lynsey Rydberg (corvus-callidus)
force-pushed
the
lyrydber/cis-account-defaults
branch
from
August 28, 2026 20:43
1ae2cae to
c2d7487
Compare
Copilot started reviewing on behalf of
Lynsey Rydberg (corvus-callidus)
August 28, 2026 20:44
View session
Lynsey Rydberg (corvus-callidus)
marked this pull request as ready for review
August 28, 2026 20:47
Lynsey Rydberg (corvus-callidus)
requested a review
from a team
as a code owner
August 28, 2026 20:47
Contributor
Author
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
| type = "file-search-replace" | ||
| file = "shadow-utils.login.defs" | ||
| regex = '(?m)^PASS_MAX_DAYS\s+\d+$' | ||
| replacement = "PASS_MAX_DAYS\t365" |
Collaborator
There was a problem hiding this comment.
question (blocking): What happens for key-only SSH users?
Copilot seems to flag that for key-only users (password-auth disabled), after 365 days, OpenSSH will change into the password update mode. And since the key-only user has no current password, they wouldn't be able to change the password, and after 30 more days, they'd get locked out fully. This key-only user creation is also our default setup in Azure VMs with cloud-init user provisioning.
Christopher Co (christopherco)
requested changes
Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Configure account-aging defaults for newly created local accounts:
Existing accounts are unchanged.
Resolves:
Testing
Built and installed
shadow-utils-4.18.0-7.azl4on an AZL4 VM. CIS-CAT Level 1 Server passes both controls.