Collect Password Evidence for Linux

Last updated: June 25, 2026

Mycroft MDM does not currently support password detection on Linux systems and must be verified manually with a screenshot.

To satisfy a security audit (such as SOC 2, ISO 27001, etc.), an auditor needs definitive proof that the operating system forces user authentication and automatically locks the screen after a period of inactivity.

Below are scripts that can be used to capture the evidence on Linux devices.

  1. Ubuntu 24.04.4 LTS

  2. Fedora Linux 42.0.0

Ubuntu 24.04.4 LTS

Save this script as collect_audit_evidence.sh.

Bash

#!/bin/bash
# Ubuntu 24.04 LTS Security Compliance Evidence Collector
# Generates an auditor-ready report verifying password protection and screen locks.

OUTPUT_FILE="ubuntu_compliance_evidence_$(date +%F_%H-%M-%S).md"

# Ensure the script is run with sudo to read system files, but track the actual user
if [ "$EUID" -ne 0 ]; then
  echo "[-] Error: This script must be run with sudo to collect system-level evidence."
  exit 1
fi

REAL_USER=${SUDO_USER:-$USER}
USER_HOME=$(eval echo "~$REAL_USER")

echo "=================================================="
echo " Gathering Security Compliance Evidence...        "
echo " Exporting to: $OUTPUT_FILE"
echo "=================================================="

{
echo "# Security Compliance Evidence Report"
echo "**Generated on:** $(date)"
echo "**Hostname:** $(hostname)"
echo "**OS Version:** $(lsb_release -d | cut -f2)"
echo "**Audited User Account:** $REAL_USER"
echo -e "\n---\n"

echo "## 1. Device Screen Lock & Inactivity Timeout Configuration"
echo "Verifies that the device automatically locks and requires a password on wake."
echo '```text'
# Query GSettings by impersonating the logged-in user session
if command -v gsettings &> /dev/null; then
    sudo -u "$REAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(id -u $REAL_USER)/bus" \
        gsettings get org.gnome.desktop.screensaver lock-enabled 2>&1 | awk '{print "Screen Lock Enabled: "$0}'
        
    sudo -u "$REAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(id -u $REAL_USER)/bus" \
        gsettings get org.gnome.desktop.session idle-delay 2>&1 | awk '{print "Inactivity Timeout (seconds): "$0}'
        
    sudo -u "$REAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(id -u $REAL_USER)/bus" \
        gsettings get org.gnome.desktop.screensaver ubuntu-lock-on-suspend 2>&1 | awk '{print "Lock on Suspend/Sleep: "$0}'
else
    echo "GNOME GSettings not found (Headless/Server Environment)."
fi
echo '```'
echo -e "\n---\n"

echo "## 2. Password Protection Status for User: $REAL_USER"
echo "Proves the account utilizes a secure, active password and is not blank."
echo '```text'
shadow_status=$(passwd -S "$REAL_USER")
echo "Password Status Key: P = Password set, L = Locked, NP = No Password"
echo "Current Status: $shadow_status"
echo '```'
echo -e "\n---\n"

echo "## 3. Privilege Escalation (Sudo) Password Requirements"
echo "Verifies that administrative actions require password re-authentication."
echo '```text'
echo "Checking for insecure NOPASSWD rules tied to the user:"
sudoers_check=$(grep -rni "NOPASSWD" /etc/sudoers /etc/sudoers.d/ 2>/dev/null)
if [ -z "$sudoers_check" ]; then
    echo "[PASS] No global NOPASSWD bypasses detected. Sudo requires password verification."
else
    echo "[WARNING] Potential NOPASSWD bypasses found in configuration:"
    echo "$sudoers_check"
fi
echo '```'
echo -e "\n---\n"

echo "## 4. System Password Quality & Hashing Algorithm"
echo "Proves the system enforces modern cryptographic standards for password storage."
echo '```text'
if grep -q "yescrypt" /etc/pam.d/common-password; then
    echo "Password Hashing Standard: yescrypt (Ubuntu 24.04 Next-Gen Default - Compliant)"
else
    grep "pam_unix.so" /etc/pam.d/common-password | awk '{print "Hashing Configuration: " $0}'
fi
echo '```'

} > "$OUTPUT_FILE"

# Clean up Markdown syntax formatting quirks in the output if no GUI exists
sed -i 's/No such schema.*/Schema not present (Server CLI Environment)/g' "$OUTPUT_FILE"

echo "[+] Evidence collection complete!"
echo "[+] Review the file using: cat $OUTPUT_FILE"

How to Execute the Collection

  1. Create the file on the machine being audited:

    Bash

    nano collect_audit_evidence.sh

  2. Paste the script above, save, and exit (Ctrl+O, Enter, Ctrl+X).

  3. Set the executable permissions:

    Bash

    chmod +x collect_audit_evidence.sh

  4. Run the script with sudo (this is required to read /etc/shadow and /etc/sudoers variants):

    Bash

    sudo ./collect_audit_evidence.sh

What the Generated Evidence File Proves to an Auditor

The script outputs a beautifully structured Markdown (.md) file. When you hand it to an auditor, it provides validation for specific compliance controls:

  • lock-enabled true: Validates the control for Access Control / Device Locking. It proves the system won't remain wide open if left unattended.

  • idle-delay uint32 300: Proves an automatic timeout is active (e.g., 300 seconds = 5 minutes). You can point to this to prove you meet the standard corporate sub-15-minute timeout window.

  • Password Status: P: Proves the interactive user profile utilizes a password (P stands for Password Set) and isn't running with a blank authentication token.

  • No NOPASSWD entries: Proves that the user cannot bypass authentication prompts when executing administrative tasks (sudo), fulfilling the Principle of Least Privilege.

  • yescrypt hashing: Proves that the local machine hashes passwords using highly secure, memory-hard algorithms resistant to brute-force attacks.

Fedora Linux 42.0.0

Save this script as collect_fedora_evidence.sh.

Bash

#!/bin/bash# Fedora Linux Security Compliance Evidence Collector# Generates an auditor-ready report verifying password protection and screen locks.

OUTPUT_FILE="fedora_compliance_evidence_$(date +%F_%H-%M-%S).md"

# Ensure the script is run with sudo to read system files, but track the actual userif [ "$EUID" -ne 0 ]; thenecho "[-] Error: This script must be run with sudo to collect system-level evidence."exit 1
fi

REAL_USER=${SUDO_USER:-$USER}

echo "=================================================="echo " Gathering Security Compliance Evidence (Fedora)..."echo " Exporting to: $OUTPUT_FILE"echo "=================================================="

{
echo "# Security Compliance Evidence Report"echo "**Generated on:** $(date)"echo "**Hostname:** $(hostname)"echo "**OS Version:** $(grep PRETTY_NAME /etc/os-release | cut -d'"' -f2)"
echo "**Audited User Account:** $REAL_USER"
echo -e "\n---\n"

echo "## 1. Device Screen Lock & Inactivity Timeout Configuration"
echo "Verifies that the workstation automatically locks and requires a password on wake."
echo '```text'
if command -v gsettings &> /dev/null; then
    USER_BUS="/run/user/$(id -u $REAL_USER)/bus"
    if [ -S "$USER_BUS" ]; then
        sudo -u "$REAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=$USER_BUS" \
            gsettings get org.gnome.desktop.screensaver lock-enabled 2>&1 | awk '{print "Screen Lock Enabled: "$0}'
            
        sudo -u "$REAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=$USER_BUS" \
            gsettings get org.gnome.desktop.session idle-delay 2>&1 | awk '{print "Inactivity Timeout (seconds): "$0}'
            
        sudo -u "$REAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=$USER_BUS" \
            gsettings get org.gnome.desktop.interface lock-delay 2>&1 | awk '{print "Lock Delay after Screen Off (seconds): "$0}'
    else
        echo "Active GUI D-Bus session not found for $REAL_USER (Headless/SSH session)."
    fi
else
    echo "GNOME GSettings not found (Non-GNOME desktop or Headless Server)."
fi
echo '```'
echo -e "\n---\n"

echo "## 2. Password Protection Status for User: $REAL_USER"
echo "Proves the account utilizes a secure, active password and is not blank."
echo '```text'
shadow_status=$(passwd -S "$REAL_USER")
echo "Password Status Key: P = Password set, L = Locked, NP = No Password"
echo "Current Status: $shadow_status"
echo '```'
echo -e "\n---\n"

echo "## 3. Privilege Escalation (Sudo) Password Requirements"echo "Verifies that administrative actions require password re-authentication."echo '```text'echo "Checking for insecure NOPASSWD rules tied to the user:"
sudoers_check=$(grep -rni "NOPASSWD" /etc/sudoers /etc/sudoers.d/ 2>/dev/null)
if [ -z "$sudoers_check" ]; then
    echo "[PASS] No global NOPASSWD bypasses detected. Sudo requires password verification."else
    echo "[WARNING] Potential NOPASSWD bypasses found in configuration:"
    echo "$sudoers_check"fiecho '```'echo -e "\n---\n"

echo "## 4. System Password Quality & Hashing Algorithm"echo "Proves Fedora enforces modern cryptographic standards via authselect."echo '```text'if command -v authselect &> /dev/null; then
    echo "Active Authselect Profile:"
    authselect current
    echo ""fi

if [ -f /etc/pam.d/system-auth ]; then
    if grep -q "yescrypt" /etc/pam.d/system-auth; then
        echo "Password Hashing Standard: yescrypt (Fedora Default - Compliant)"
    else
        grep "pam_unix.so" /etc/pam.d/system-auth | awk '{print "Hashing Configuration: " $0}'
    fielse
    echo "PAM configuration file 'system-auth' not found."fiecho '```'

} > "$OUTPUT_FILE"

# Clean up Markdown syntax formatting quirks in the output if no GUI exists
sed -i 's/No such schema.*/Schema not present/g' "$OUTPUT_FILE"

echo "[+] Evidence collection complete!"echo "[+] Review the file using: cat $OUTPUT_FILE"

How to Run It on Fedora

  1. Open your terminal and create the file:

    Bash

    nano collect_fedora_evidence.sh

  2. Paste the script content above, save, and exit (Ctrl+O, Enter, Ctrl+X).

  3. Elevate permissions to make it executable:

    Bash

    chmod +x collect_fedora_evidence.sh

  4. Run the script utilizing sudo:

    Bash

    sudo ./collect_fedora_evidence.sh

Fedora Specific Auditing Notes

  • PAM Files: Unlike Ubuntu's common-password, Fedora handles its centralized local authentication profile inside /etc/pam.d/system-auth. The script scans this file specifically to pull your hashing algorithms.

  • Authselect Verification: Fedora relies heavily on authselect to maintain standard deployment profiles (like sssd or local). The script outputs the authselect current configuration to prove to an auditor that security profile tampering hasn't occurred.

  • OS String Mapping: Fedora extracts the system version information elegantly out of /etc/os-release since lsb_release tools are typically omitted out-of-the-box on clean Workstation/Server installations.