How to manage Linux password expiry with the chage command

As a Linux admin, you're probably accustomed to passwdchownchmod, and chgrp...all commands for managing various elements of user accounts, files, and folders. There is another command that all Linux administrators must know: chage (think of change age).

With the chage command you can change the number of days between password changes, set a manual expiration date, list account aging information, and more. It's a very handy tool for any admin wanting to ensure their users stay on top of changing their passwords regularly.

SEE: Want a good tech job? Report says open-source skills are hotter than ever (ZDNet)

Installing chage

 

 

There is no installation needed for this tool, as it should be found on your distribution by default. As you probably expect, chage is a command line tool, so you'll be required to work within a terminal window.

Using chage

The basic structure for the chage command looks like:

chage [options] USERNAME

You can choose from plenty of options—the most immediately useful of those options are:

  • -E Set the expire date for a user password. The date is expressed in the format YYYY-MM-DD.
  • -I Set the number of inactive days allowed, after a password expires, before the account is locked.
  • -l List the account aging information.
  • -m Set the minimum number of days allowed between password changes. Setting this option to 0 allows the user to change their password at any time.
  • -M Set the maximum number of days in which a password is valid.
  • -W Set the number of days of warning before a user must change their password.

Examples of chage in action

 

We'll manage the password for user bethany. First, let's list the account aging information for bethany. To do this, we issue the command:

sudo chage -l bethany

This command should produce something similar to Figure A.

Figure A

 

Figure A
Account aging information for user bethany.
Image: Jack Wallen

 

Now let's set bethany's password to expire on July 10, 2016. The command would be:

sudo chage -E 2016-07-10 bethany

When we execute chage -l bethany, we see the expiration date listed (Figure B).

Figure B

 

Figure B
A new expiration date for bethany's password.
Image: Jack Wallen

 

A better way to set an expiration date is to set the number of days since the last password change; this will remain in effect until the administrator removes or changes that option. Say you want passwords to be changed every 30 days—you would issue the command:

sudo chage -E 30 bethany

The next time the user changes their password, the days between will reset, and they will have a fresh 30 days before their password expires.

If you've added an explicit expiration date, you can remove it with the command:

sudo chage -E -1 bethany

Our next move will be to give the user a warning that their password will expire. By default, the warning will be issued seven days in advance (this is only set once you create an expiration date for the password or the number of days between password changes). Let's change that warning to one day in advance (because who needs more than that?). To set this, issue the command:

sudo chage -W 1 bethany

You should see the change in warning days reflected in the new output (Figure C).

Figure C

 

Figure C
Bethany will now get a warning the day before her password expires.
Image: Jack Wallen

 

What happens when bethany attempts to log in to a machine once her password has expired? If she's ssh'ing from another machine, she'll get a clear warning (Figure D).

Figure D

 

Figure D
Uh oh, the password has expired for bethany.
Image: Jack Wallen

 

Bethany will get the same warning should she attempt to log on to her desktop as well. To rectify that, her password must be changed.

You can set the number of days after a password has expired before an account will be locked. Once an account is locked, it can only be unlocked by an administrator. To set this option, the command would look like:

sudo chage -I 10 bethany

Once that command has been issued, the account for bethany will lock 10 days after her password has expired. This particular option does not show in the chage -l command, so a user will not know how many days they have, after their password has expired, before the account is locked.

Make use of chage

I highly recommend every Linux admin take charge of user password expiration with the chage command. Security is a must, and if users aren't changing their passwords regularly, your data could be at risk. The chage command can certainly help you ensure those passwords are changed.

0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
Linux nslookup Command Examples for DNS Lookup
Viewed 514 times since Sat, Sep 29, 2018
Logrotate Example for Custom Logs
Viewed 744 times since Sun, Jan 12, 2020
Linux – How to check the exit status of several piped commands
Viewed 1155 times since Wed, Jul 25, 2018
debian Install a newer kernel in Debian 9 (stretch) stable
Viewed 468 times since Sun, Sep 23, 2018
ZFS: Verify/change properties of a zfs filesystem
Viewed 633 times since Sun, Jun 3, 2018
Oracle Linux 7 – How to audit changes to a trusted file such as /etc/passwd or /etc/shadow
Viewed 1070 times since Wed, Jul 25, 2018
RHEL: Getting/Setting hardware clock’s time
Viewed 923 times since Sat, Jun 2, 2018
Szybkie sprawdzenie zewnętrznego adresu IP i hosta
Viewed 830 times since Thu, May 24, 2018
OpenSSL: Find Out SSL Key Length – Linux Command Line
Viewed 430 times since Mon, Feb 18, 2019
How To Ping Specific Port Number
Viewed 185 times since Mon, Jun 1, 2020