[Linux 文章收集] 7 Examples to Manage Linux Password Expiration and Aging Using chage

Source From Here
Preface
Best practice recommends that users keep changing the passwords at a regular interval. But typically developers and other users of Linux system won’t change the password unless they are forced to change their password. It’s the system administrators responsibility to find a way to force developers to change their password. Forcing users to change their password with a gun on their head is not an option!. While most security conscious sysadmins may be even tempted to do that.

In this article let us review how you can use Linux chage command to perform several practical password aging activities including how-to force users to change their password.

7 Examples to Manage Linux Password Expiration and Aging

1. List the password and its related details for an user
As shown below, any user can execute the chage command for himself to identify when his password is about to expire.

// Syntax: chage –-list username (or) chage -l username
# chage --list john
Last password change : Oct 07, 2016
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7

If user peter tries to execute the same command for user john, he’ll get the following permission denied message.

$ chage -l john
chage: Permission denied.

Note: However, a root user can execute chage command for any user account.

When user peter changes his password on Jun 03, 2017, it will update the “Last password change” value as shown below.

$ date // Now is account peter and changed password few seconds ago
Sat Jun 3 08:58:27 CST 2017
$ chage --list peter
Last password change : Jun 03, 2017
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7

Please refer to our earlier article: Best Practices and Ultimate Guide For Creating Super Strong Password, which will help you to follow the best practices while changing password for your account.

2. Set Password Expiry Date for an user using chage option -M
Root user (system administrators) can set the password expiry date for any user. In the following example, user peter password is set to expire 10 days from the last password change. Please note that option -M will update both “Password expires” and “Maximum number of days between password change” entries as shown below.

// Syntax: # chage -M number-of-days username

// -M, --maxdays MAX_DAYS: Set the maximum number of days during which a password is valid.
# chage -M 10 peter
# chage --list peter
Last password change : Jun 03, 2017
Password expires : Jun 13, 2017
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 10
Number of days of warning before password expires : 7

3. Password Expiry Warning message during login
By default the number of days of warning before password expires is set to 7. So, in the above example, when the user peter tries to login on Jun 7, 2017 — he’ll get the following message.

# date +"%Y%m%d" -s "20170608" // Change the system date to force password of peter to be about expired
20170608
# date
Thu Jun 8 00:00:03 CST 2017

# ssh peter@localhost // Login account peter with ssh
...
peter@localhost's password:
Warning: your password will expire in 6 days

4. User Forced to Change Password after Expiry Date
If the password expiry date reaches and user doesn’t change their password, the system will force the user to change the password before the login as shown below:

# date +"%Y%m%d" -s "20170620" // Force the password of peter to expire
20170620
# ssh peter@localhost
...
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user peter.
Changing password for peter.
(current) UNIX password:

5. Set the Account Expiry Date for an User
You can also use chage command to set the account expiry date as shown below using option -E. The date given below is in “YYYY-MM-DD” format. This will update the “Account expires” value as shown below.

# chage -E "2017-07-31" peter
# chage -l peter
Last password change : Jun 03, 2017
Password expires : Jun 13, 2017
Password inactive : never
Account expires : Jul 31, 2017
Minimum number of days between password change : 0
Maximum number of days between password change : 10
Number of days of warning before password expires : 7

6. Force the user account to be locked after X number of inactivity days
Typically if the password is expired, users are forced to change it during their next login. You can also set an additional condition, where after the password is expired, if the user never tried to login for 10 days, you can automatically lock their account using option -I as shown below. In this example, the “Password inactive” date is set to 10 days from the “Password expires” value:

# chage -I 10 peter
# chage -l peter
Last password change : Jun 03, 2017
Password expires : Jun 13, 2017
Password inactive : Jun 23, 2017
Account expires : Jul 31, 2017
Minimum number of days between password change : 0
Maximum number of days between password change : 10
Number of days of warning before password expires : 7

Once an account is locked, only system administrators will be able to unlock it.

7. How to disable password aging for an user account
To turn off the password expiration for an user account, set the following:

* -m 0 will set the minimum number of days between password change to 0
* -M 99999 will set the maximum number of days between password change to 99999
* -I -1 (number minus one) will set the “Password inactive” to never
* -E -1 (number minus one) will set “Account expires” to never.

For example:

# chage -m 0 -M 99999 -I -1 -E -1 peter
# chage -l peter
Last password change : Jun 03, 2017
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7