How to manage Linux password expiry with the chage command

As a Linux admin, you're probably accustomed to passwdchownchmod, and chgrp...all commands for managing various elements of user accounts, files, and folders. There is another command that all Linux administrators must know: chage (think of change age).

With the chage command you can change the number of days between password changes, set a manual expiration date, list account aging information, and more. It's a very handy tool for any admin wanting to ensure their users stay on top of changing their passwords regularly.

SEE: Want a good tech job? Report says open-source skills are hotter than ever (ZDNet)

Installing chage



There is no installation needed for this tool, as it should be found on your distribution by default. As you probably expect, chage is a command line tool, so you'll be required to work within a terminal window.

Using chage

The basic structure for the chage command looks like:

chage [options] USERNAME

You can choose from plenty of options—the most immediately useful of those options are:

  • -E Set the expire date for a user password. The date is expressed in the format YYYY-MM-DD.
  • -I Set the number of inactive days allowed, after a password expires, before the account is locked.
  • -l List the account aging information.
  • -m Set the minimum number of days allowed between password changes. Setting this option to 0 allows the user to change their password at any time.
  • -M Set the maximum number of days in which a password is valid.
  • -W Set the number of days of warning before a user must change their password.

Examples of chage in action


We'll manage the password for user bethany. First, let's list the account aging information for bethany. To do this, we issue the command:

sudo chage -l bethany

This command should produce something similar to Figure A.

Figure A


Figure A
Account aging information for user bethany.
Image: Jack Wallen


Now let's set bethany's password to expire on July 10, 2016. The command would be:

sudo chage -E 2016-07-10 bethany

When we execute chage -l bethany, we see the expiration date listed (Figure B).

Figure B


Figure B
A new expiration date for bethany's password.
Image: Jack Wallen


A better way to set an expiration date is to set the number of days since the last password change; this will remain in effect until the administrator removes or changes that option. Say you want passwords to be changed every 30 days—you would issue the command:

sudo chage -E 30 bethany

The next time the user changes their password, the days between will reset, and they will have a fresh 30 days before their password expires.

If you've added an explicit expiration date, you can remove it with the command:

sudo chage -E -1 bethany

Our next move will be to give the user a warning that their password will expire. By default, the warning will be issued seven days in advance (this is only set once you create an expiration date for the password or the number of days between password changes). Let's change that warning to one day in advance (because who needs more than that?). To set this, issue the command:

sudo chage -W 1 bethany

You should see the change in warning days reflected in the new output (Figure C).

Figure C


Figure C
Bethany will now get a warning the day before her password expires.
Image: Jack Wallen


What happens when bethany attempts to log in to a machine once her password has expired? If she's ssh'ing from another machine, she'll get a clear warning (Figure D).

Figure D


Figure D
Uh oh, the password has expired for bethany.
Image: Jack Wallen


Bethany will get the same warning should she attempt to log on to her desktop as well. To rectify that, her password must be changed.

You can set the number of days after a password has expired before an account will be locked. Once an account is locked, it can only be unlocked by an administrator. To set this option, the command would look like:

sudo chage -I 10 bethany

Once that command has been issued, the account for bethany will lock 10 days after her password has expired. This particular option does not show in the chage -l command, so a user will not know how many days they have, after their password has expired, before the account is locked.

Make use of chage

I highly recommend every Linux admin take charge of user password expiration with the chage command. Security is a must, and if users aren't changing their passwords regularly, your data could be at risk. The chage command can certainly help you ensure those passwords are changed.

0 (0)
Article Rating (No Votes)
Rate this article
There are no attachments for this article.
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
RHCS6: Basic operations on clustered services
Viewed 1633 times since Sun, Jun 3, 2018
RHEL7: Configure automatic updates.
Viewed 964 times since Wed, Oct 17, 2018
RHEL7 slow ssh login
Viewed 2651 times since Tue, Aug 6, 2019
20 Practical Examples of RPM Commands in Linux rpm
Viewed 6104 times since Mon, Feb 18, 2019
How to Migrate from RHEL 8 to CentOS 8
Viewed 1242 times since Fri, May 15, 2020
CentOS / RHEL 7 : Configuring an NFS server and NFS client Linux NFS
Viewed 14576 times since Fri, Feb 21, 2020
List usernames instead of uids with the ps command for long usernames
Viewed 1075 times since Wed, Jul 25, 2018
Linux RedHat How To Create An RPM Package
Viewed 50 times since Sun, Jan 9, 2022
Linux / UNIX: DNS Lookup Command
Viewed 8708 times since Sun, Sep 30, 2018
LVM: Reduce root PV/VG
Viewed 3526 times since Sat, Jun 2, 2018