Introduction

In light of recent reports of data breaches at internet giants like: Dropbox, LinkedIn, or Yahoo, it seems like good practice to force users to change their passwords regularly, especially since many people still use one password for multiple services.

Setting password expiration for new users

When creating a user account with the useradd command or the more friendly adduser (a perl script wrapping useradd), we pull certain default settings from the /etc/login.defs file, i.e. the maximum number of days a password is valid, the number of days before password expiration when the user will be warned, and whether the new user's home directory should be created automatically. In this case we're interested in the options for password validity:

• PASS_MAX_DAYS - maximum number of days a password is valid
• PASS_MIN_DAYS - minimum number of days a password is valid
• PASS_MIN_LEN - minimum number of characters the password should consist of
• PASS_WARN_AGE - number of days before password expiration when the user will be warned

Setting password expiration for existing users

For existing users we can easily manipulate "password validity" using the chage command. With this application, the administrator can enforce a minimum, maximum time between password changes, or the number of days preceding password expiration when an appropriate message will be displayed during login.

Password information:

The following information can be displayed by any user (without administrator privileges).

# chage -l dominik
Last password change                                    : Sep 30, 2015
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7

Maximum number of days a password is valid

# chage -M 120 dominik

After 120 days, upon logging in the user will be asked to change their current password.

WARNING: Your password has expired.
You must change your password now and login again!
Changing password for dominik.
(current) UNIX password:
Enter new UNIX password:
Retype new UNIX password:
Bad: new and old password are too similar
Enter new UNIX password:

Forcing a password change at the next login

# chage –d 0 dominik

Password change notice

Warning: your password will expire in 6 days

By default the above message is displayed 7 days before the password's validity expires. We can change this with:

# chage –W 14 dominik

Restoring default settings

# chage -m 0 -M 99999 -I -1 -E -1 dominik