How to manage Linux password expiry with the chage command

As a Linux admin, you're probably accustomed to passwdchownchmod, and chgrp...all commands for managing various elements of user accounts, files, and folders. There is another command that all Linux administrators must know: chage (think of change age).

With the chage command you can change the number of days between password changes, set a manual expiration date, list account aging information, and more. It's a very handy tool for any admin wanting to ensure their users stay on top of changing their passwords regularly.

SEE: Want a good tech job? Report says open-source skills are hotter than ever (ZDNet)

Installing chage

 

 

There is no installation needed for this tool, as it should be found on your distribution by default. As you probably expect, chage is a command line tool, so you'll be required to work within a terminal window.

Using chage

The basic structure for the chage command looks like:

chage [options] USERNAME

You can choose from plenty of options—the most immediately useful of those options are:

  • -E Set the expire date for a user password. The date is expressed in the format YYYY-MM-DD.
  • -I Set the number of inactive days allowed, after a password expires, before the account is locked.
  • -l List the account aging information.
  • -m Set the minimum number of days allowed between password changes. Setting this option to 0 allows the user to change their password at any time.
  • -M Set the maximum number of days in which a password is valid.
  • -W Set the number of days of warning before a user must change their password.

Examples of chage in action

 

We'll manage the password for user bethany. First, let's list the account aging information for bethany. To do this, we issue the command:

sudo chage -l bethany

This command should produce something similar to Figure A.

Figure A

 

Figure A
Account aging information for user bethany.
Image: Jack Wallen

 

Now let's set bethany's password to expire on July 10, 2016. The command would be:

sudo chage -E 2016-07-10 bethany

When we execute chage -l bethany, we see the expiration date listed (Figure B).

Figure B

 

Figure B
A new expiration date for bethany's password.
Image: Jack Wallen

 

A better way to set an expiration date is to set the number of days since the last password change; this will remain in effect until the administrator removes or changes that option. Say you want passwords to be changed every 30 days—you would issue the command:

sudo chage -E 30 bethany

The next time the user changes their password, the days between will reset, and they will have a fresh 30 days before their password expires.

If you've added an explicit expiration date, you can remove it with the command:

sudo chage -E -1 bethany

Our next move will be to give the user a warning that their password will expire. By default, the warning will be issued seven days in advance (this is only set once you create an expiration date for the password or the number of days between password changes). Let's change that warning to one day in advance (because who needs more than that?). To set this, issue the command:

sudo chage -W 1 bethany

You should see the change in warning days reflected in the new output (Figure C).

Figure C

 

Figure C
Bethany will now get a warning the day before her password expires.
Image: Jack Wallen

 

What happens when bethany attempts to log in to a machine once her password has expired? If she's ssh'ing from another machine, she'll get a clear warning (Figure D).

Figure D

 

Figure D
Uh oh, the password has expired for bethany.
Image: Jack Wallen

 

Bethany will get the same warning should she attempt to log on to her desktop as well. To rectify that, her password must be changed.

You can set the number of days after a password has expired before an account will be locked. Once an account is locked, it can only be unlocked by an administrator. To set this option, the command would look like:

sudo chage -I 10 bethany

Once that command has been issued, the account for bethany will lock 10 days after her password has expired. This particular option does not show in the chage -l command, so a user will not know how many days they have, after their password has expired, before the account is locked.

Make use of chage

I highly recommend every Linux admin take charge of user password expiration with the chage command. Security is a must, and if users aren't changing their passwords regularly, your data could be at risk. The chage command can certainly help you ensure those passwords are changed.

0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
RHEL: Bonding network interfaces
Viewed 1435 times since Sat, Jun 2, 2018
Deskshare TLS over Stunnel
Viewed 923 times since Fri, Sep 28, 2018
A tcpdump Tutorial and Primer with Examples
Viewed 2172 times since Sun, Jun 17, 2018
BIND for the Small LAN
Viewed 1769 times since Sun, May 20, 2018
How to enable Proxy Settings for Yum Command on RHEL / CentOS Servers
Viewed 1845 times since Thu, Jul 19, 2018
20 Practical Examples of RPM Commands in Linux rpm
Viewed 1566 times since Mon, Feb 18, 2019
systemctl Use systemd to Start a Linux Service at Boot
Viewed 241 times since Mon, Dec 7, 2020
How to maximise SSD performance with Linux
Viewed 3517 times since Fri, May 15, 2020
RHEL: udev rules basics
Viewed 1706 times since Sat, Jun 2, 2018
stunnel Howto A Guide to create SSL access to a HTTP-only webserver with stunnel
Viewed 834 times since Fri, Sep 28, 2018