From fe2d2b45bb66df98b91e6b42f4a5755a84516be7 Mon Sep 17 00:00:00 2001
From: jonnyCodev <yonicodev@gmail.com>
Date: Thu, 6 Feb 2020 11:10:10 +0200
Subject: [PATCH 1/2] check root account access login and fail if used in the
 last day

---
 checks/check11 | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/checks/check11 b/checks/check11
index a72c704c..1150ac8b 100644
--- a/checks/check11
+++ b/checks/check11
@@ -16,6 +16,14 @@ CHECK_ALTERNATE_check101="check11"
 
 check11(){
   # "Avoid the use of the root account (Scored)."
-  COMMAND11=$(cat $TEMP_REPORT_FILE| grep '<root_account>' | cut -d, -f5,11,16 | sed 's/,/\ /g')
-  textInfo "Root account last accessed (password key_1 key_2): $COMMAND11"
+  MAX_DAYS=-1
+  last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep '<root_account>' | awk '{ print $2 }')
+  arn=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$2 }' |grep '<root_account>' | awk '{ print $2 }')
+  days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
+
+  if [ "$days_not_in_use" -gt "$MAX_DAYS" ];then
+      textFail "Root Account $arn last accessed was less then ${MAX_DAYS#-} day ago"
+  else
+      textPass "Root Account $arn last accessed was more then ${MAX_DAYS#-} day ago"
+  fi
 }

From 447657140d74e83d8781fdf2ee7453af144960ac Mon Sep 17 00:00:00 2001
From: jonnyCodev <yonicodev@gmail.com>
Date: Wed, 12 Feb 2020 10:16:18 +0200
Subject: [PATCH 2/2] check if last_login_date is a valid date

---
 checks/check11 | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/checks/check11 b/checks/check11
index 1150ac8b..924a14eb 100644
--- a/checks/check11
+++ b/checks/check11
@@ -19,11 +19,17 @@ check11(){
   MAX_DAYS=-1
   last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep '<root_account>' | awk '{ print $2 }')
   arn=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$2 }' |grep '<root_account>' | awk '{ print $2 }')
-  days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
 
-  if [ "$days_not_in_use" -gt "$MAX_DAYS" ];then
-      textFail "Root Account $arn last accessed was less then ${MAX_DAYS#-} day ago"
+  #check if last_login_date date is a valid date, if not, its a pass.
+  if [[ ${last_login_date%T*} =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]];then
+    days_not_in_use=$(how_many_days_from_today ${last_login_date%T*})
+    if [ "$days_not_in_use" -gt "$MAX_DAYS" ];then
+        textFail "Root Account $arn last accessed was less then ${MAX_DAYS#-} day ago"
+    else
+        textPass "Root Account $arn last accessed was more then ${MAX_DAYS#-} day ago"
+    fi
   else
-      textPass "Root Account $arn last accessed was more then ${MAX_DAYS#-} day ago"
+    textPass "Root Account $arn last accessed was more then ${MAX_DAYS#-} day ago"
   fi
+
 }