Managing Passwords with passwd and chage

1. Understanding Password and Account Aging

Before we use any commands, let's define the key policies you can enforce. An organization's security policy often dictates these settings, and as a system administrator, your job is to implement them.

These settings give you granular control. For instance, setting a "Minimum number of days" prevents a user from cycling through passwords just to reuse their old favorite one, which subverts password history policies. Setting an "Account expiry date" is perfect for managing access for temporary team members without needing a manual reminder to disable their account.

2. The chage Command: The Main Tool for Policy Management

The primary command for managing all these aging settings is chage (which stands for change age). It allows you to view and modify password and account expiration information for any user.

Let's see it in action.

Here is a summary of the key chage flags:

3. Using passwd for Quick Policy Checks and Changes

While chage is the comprehensive tool, the passwd command also has a few useful flags for viewing password status and forcing expiration. Since you already use passwd to set initial passwords, these flags can be convenient.

While passwd can modify some aging settings, chage is generally preferred for its clarity and comprehensive options. Think of chage as the dedicated policy manager.

4. Setting System-Wide Defaults

Applying policies to users one by one is fine for a few accounts, but what about setting a baseline for all new users on your system? This is handled by the /etc/login.defs file.

This file contains default configuration values for user-creation tools. When you run useradd, it looks at /etc/login.defs to determine the default password aging policies for the new account.

Modifying /etc/login.defs ensures your security baseline is applied automatically as your team grows. For any existing users, you must still use chage to update their policies individually.

5. Do-It-Yourself: Implementing Security Policies

Now it's time to put this all into practice. Imagine you are the system administrator for a project. You need to onboard a new full-time developer and a short-term contractor, and also handle a security request for an existing user.

Open your terminal and follow these steps.

1. Create New User Accounts:
   First, create the two new users. We will set their initial passwords right away.

   sudo useradd -m dev_perm
   sudo useradd -m dev_temp
   
   
   
   
   # Set initial passwords (you will be prompted)
   sudo passwd dev_perm
   sudo passwd dev_temp
   

2. Apply Policy for the Permanent Developer:
   Your company policy requires permanent staff to change their password every 90 days. They should get a warning 7 days beforehand, and they cannot change their password more than once per day.

   
   
   
   # Apply the policy to dev_perm
   sudo chage -M 90 -W 7 -m 1 dev_perm
   
   
   
   
   # Verify the changes
   sudo chage -l dev_perm
   

   Look at the output and confirm that "Maximum number of days between password change" is 90, "Minimum" is 1, and "Number of days of warning" is 7.

3. Apply Policy for the Temporary Contractor:
   The contractor's project is scheduled to end in 30 days. Set their account to automatically expire on that date.
   Hint: You can use the date command to calculate the date for you!

   
   
   
   # Set the account to expire in 30 days
   sudo chage -E $(date -d +30days +%Y-%m-%d) dev_temp
   
   
   
   
   # Verify the change
   sudo chage -l dev_temp
   

   Check the "Account expires" field. It should now show a date 30 days from today.

4. Force an Immediate Password Change:
   You've been notified of a potential security issue with the alice account (created in a previous lesson). You must force her to change her password the next time she logs in.

   
   
   
   # Expire the password for user alice
   sudo passwd -e alice
   
   
   
   
   # Verify the change. Note the "Password expires" date.
   sudo chage -l alice
   

   The "Last password change" field will be set to Password must be changed, indicating success.

5. (Optional) Update System-Wide Defaults:
   Management has decided on a new company-wide policy: all new accounts should have a password lifetime of 180 days. Update the default configuration.

   
   
   
   # First, it's always wise to back up a config file before editing
   sudo cp /etc/login.defs /etc/login.defs.backup
   
   
   
   
   # Use a text editor like 'vim' or 'nano' to change the value.
   # Find the line 'PASS_MAX_DAYS' and change 99999 to 180.
   sudo nano /etc/login.defs
   
   
   
   
   # Now, create a new test user
   sudo useradd test_policy_user
   
   
   
   
   # Check the new user's aging settings. It should reflect the new default.
   sudo chage -l test_policy_user
   

   You will see that test_policy_user has a maximum password age of 180 days, while older users like dev_perm retain their custom settings.

Conclusion

Great work! You have now added a crucial layer of automated security to your user management skills. By enforcing password and account lifecycle policies, you reduce risk and improve your server's security posture.

Key Takeaways:

• Password and account aging policies are a fundamental part of system security.
• The chage command is the primary tool for viewing (-l) and modifying (-M, -m, -W, -E) these policies for existing users.
• The passwd command can be used for quick status checks (-S) and to force immediate password expiration (-e).
• System-wide default policies for new users are configured in the /etc/login.defs file.

In the previous lessons, you've created standard, unprivileged users. In our next lesson, we will address a common administrative need: granting a user administrative privileges. You'll learn how to add a user to the wheel group to give them sudo access, the standard and secure way to perform administrative tasks on Fedora.