How to manage Linux password expiry with the chage command

As a Linux admin, you're probably accustomed to passwd, chown, chmod, and chgrp...all commands for managing various elements of user accounts, files, and folders. There is another command that all Linux administrators must know: chage (think of change age).

With the chage command you can change the number of days between password changes, set a manual expiration date, list account aging information, and more. It's a very handy tool for any admin wanting to ensure their users stay on top of changing their passwords regularly.

SEE: Want a good tech job? Report says open-source skills are hotter than ever (ZDNet)

Installing chage

There is no installation needed for this tool, as it should be found on your distribution by default. As you probably expect, chage is a command line tool, so you'll be required to work within a terminal window.

Using chage

The basic structure for the chage command looks like:

chage [options] USERNAME

You can choose from plenty of options—the most immediately useful of those options are:

• -E Set the expire date for a user password. The date is expressed in the format YYYY-MM-DD.
• -I Set the number of inactive days allowed, after a password expires, before the account is locked.
• -l List the account aging information.
• -m Set the minimum number of days allowed between password changes. Setting this option to 0 allows the user to change their password at any time.
• -M Set the maximum number of days in which a password is valid.
• -W Set the number of days of warning before a user must change their password.

Examples of chage in action

We'll manage the password for user bethany. First, let's list the account aging information for bethany. To do this, we issue the command:

sudo chage -l bethany

This command should produce something similar to Figure A.

Figure A

Now let's set bethany's password to expire on July 10, 2016. The command would be:

sudo chage -E 2016-07-10 bethany

When we execute chage -l bethany, we see the expiration date listed (Figure B).

Figure B

A better way to set an expiration date is to set the number of days since the last password change; this will remain in effect until the administrator removes or changes that option. Say you want passwords to be changed every 30 days—you would issue the command:

sudo chage -E 30 bethany

The next time the user changes their password, the days between will reset, and they will have a fresh 30 days before their password expires.

If you've added an explicit expiration date, you can remove it with the command:

sudo chage -E -1 bethany

Our next move will be to give the user a warning that their password will expire. By default, the warning will be issued seven days in advance (this is only set once you create an expiration date for the password or the number of days between password changes). Let's change that warning to one day in advance (because who needs more than that?). To set this, issue the command:

sudo chage -W 1 bethany

You should see the change in warning days reflected in the new output (Figure C).

Figure C

What happens when bethany attempts to log in to a machine once her password has expired? If she's ssh'ing from another machine, she'll get a clear warning (Figure D).

Figure D

Bethany will get the same warning should she attempt to log on to her desktop as well. To rectify that, her password must be changed.

You can set the number of days after a password has expired before an account will be locked. Once an account is locked, it can only be unlocked by an administrator. To set this option, the command would look like:

sudo chage -I 10 bethany

Once that command has been issued, the account for bethany will lock 10 days after her password has expired. This particular option does not show in the chage -l command, so a user will not know how many days they have, after their password has expired, before the account is locked.

Make use of chage

I highly recommend every Linux admin take charge of user password expiration with the chage command. Security is a must, and if users aren't changing their passwords regularly, your data could be at risk. The chage command can certainly help you ensure those passwords are changed.