Managing Password Aging with `chage`

1. The "Why": Understanding Password Aging Policies

Before we jump into the commands, let's establish the theoretical foundation. A password aging policy is a set of rules that defines how long a password can be used and what happens when it expires. Implementing these policies helps mitigate the risk of compromised passwords being used indefinitely.

To get a clear understanding of the different components of a password aging policy, let's start with a reading that breaks them down.

The seven settings you just read about work together to create a timeline for a password's validity. This can be easier to understand visually.

To summarize the key policy settings you'll be managing:

• Minimum Days: The number of days a user must wait before they can change their password again. This prevents users from cycling through passwords quickly to reuse an old favorite.
• Maximum Days: The number of days a password remains valid. This is the core of password expiration.
• Warning Days: The number of days before a password expires that the user will start receiving a warning message.
• Inactive Days: The number of days after a password expires that the user can still log in (but will be forced to change it) before the account is locked. This is a "grace period."
• Account Expiration Date: A fixed date when the entire account is disabled, regardless of the password's status. This is very useful for temporary accounts (e.g., for contractors or interns).

2. Viewing and Modifying Policies with chage

Now that you understand the concepts, let's put them into practice with the chage command. You will need to use sudo for all chage operations, as they modify the /etc/shadow file, which is owned by root.

Listing the Current Policy (-l)

The first step is always to check the current settings for a user. You can do this with the -l (list) option.

sudo chage -l <username>

This command displays all the aging information for the specified user in a human-readable format. Let's watch a short video that walks through this output.

Modifying Individual Policy Settings

The chage command provides specific options (flags) to modify each policy setting. The Baeldung article "Guide to Linux chage Command With Examples" serves as an excellent reference for these options. We will walk through the most important ones.

Let's break down the key options, using the Baeldung article as our guide.

• Set Maximum Password Age (-M): This sets the number of days a password is valid.
  sudo chage -M 90 jsmith (Sets password to expire in 90 days)

• Set Minimum Password Age (-m): This sets the minimum number of days between changes.
  sudo chage -m 7 jsmith (User must wait 7 days before changing again)

• Set Warning Period (-W): This sets how many days before expiration the warnings begin.
  sudo chage -W 14 jsmith (Warnings start 14 days before the password expires)

• Set Inactive Period (-I): This sets the grace period after expiration before the account is locked. The I is a capital i.
  sudo chage -I 30 jsmith (User has 30 days to log in and change their expired password)

• Set Account Expiration Date (-E): This sets a fixed date for the account to be disabled. The date format is YYYY-MM-DD.
  sudo chage -E 2024-12-31 jsmith (Account will be disabled on Dec 31, 2024)

This next video demonstrates a few of these options in action, which can help solidify your understanding.

You can also combine these options into a single command for efficiency:
sudo chage -M 90 -m 7 -W 14 -E 2024-12-31 jsmith

Forcing an Immediate Password Change (-d 0)

In the last lesson, you learned to use passwd -e to expire a user's password. An equivalent and very common method is using chage to set the "last password change" date to 0 (which corresponds to the date January 1st, 1970). This effectively marks the password as expired immediately.

sudo chage -d 0 <username>

The next time the user logs in, they will be forced to create a new password.

3. Interactive Mode and System Defaults

While using flags is efficient for scripting and specific changes, chage also has an interactive mode. If you run it with just a username, it will prompt you for each value.

sudo chage <username>

This can be helpful when you're setting up a policy for the first time and want to be guided through the options.

Finally, it's useful to know where the system-wide default password aging policies are stored. These are applied to any new user you create. These defaults are located in the /etc/login.defs file. You can edit this file as an administrator to ensure all new users automatically conform to your organization's security policy.

Conclusion

In this lesson, you have gained a comprehensive understanding of how to implement and manage password aging policies in Linux, a critical skill for both system administration and the CompTIA Linux+ exam.

Key Takeaways:

• Password aging policies are a set of rules that enforce password expiration and complexity over time.
• The chage command is the primary tool for managing these policies on a per-user basis.
• You can view a user's current policy with chage -l <username>.
• The most important options for modifying policies are:
  • -M (Maximum days)
  • -m (Minimum days)
  • -W (Warning days)
  • -I (Inactive days)
  • -E (Account Expiration date)
• You can force an immediate password change with chage -d 0 <username>.
• System-wide default policies for new users are defined in /etc/login.defs.

We've now covered user creation, password management with passwd, and password policy enforcement with chage. We've also used the sudo command extensively to perform these administrative tasks. In our next lesson, we will shift our focus to privilege escalation itself and learn how to grant sudo privileges and use the visudo command to safely manage the sudoers file.