Linux passwd Command: Managing Passwords and Account Expiration

The passwd command in Linux sets the password for a specific user account. If the user account is not provided as a parameter, passwd changes the password of the currently used account. For security reasons, it is not possible to pass the password on the command line.

The available option is:

• -l: This option locks the user account by adding the "!" sign on Debian, or the "!!" sign on Red Hat, in the password field of the /etc/shadow file, so that the password string is no longer accepted. It is important to note that if the user uses another authentication method that does not require a password, such as an SSH key, they will still be able to log into the system. To permanently lock a user, it is recommended to use the "usermod –e" command to indicate that their account has expired.
• -u: This option does the reverse of the "-l" option, removing the exclamation mark "!" and unlocking the password.
• -d: This option deletes the account password, leaving the account without a password.
• -e: This option forces the password to expire, forcing the user to change their password on the next login.
• -n z: This option sets the minimum number of days Z for a password's lifetime.
• -x z: This option sets the maximum number of days Z for a password's lifetime.
• -w z: This option sets the number of days Z for a password's lifetime.
• -i z: This option sets the number Z of days between password expiration and the account becoming inactive.
• -S: This option shows account status information.

Only root can change other users' passwords. A regular user can run passwd to change their own password.

To change the password for user uira:

# passwd uiraEnter new password for ‘uira’: 

To see the password status of a user:

# passwd -S uirauira PS 2019-04-11 0 99999 7 -1 (Password set, SHA512 crypt.)

To lock a user account:

# passwd -l uiraLocking password for user uira.passwd: Success

Note that the locked account status becomes "LK":

# passwd -S uirauira LK 2019-04-11 0 99999 7 -1 (Password locked.)

That way, the password in the /etc/shadow file now has two asterisks "!!":

# cat /etc/shadow|grep uirauira:!!$6$MqPxvBfi$ZiKAPicCjTbCvLrPHut.ZeSmqVVlHsZJmHtJWofHOV.6eSz3W8G.Iw7FOguMNb9240KnKK8.5KpCQKqn/WSgm/:17998:0:99999:7:::

To unlock a password:

# passwd -u uiraUnlocking password for user uira.passwd: Success

Now the status is back to "PS":

# passwd -S uirauira PS 2019-04-11 0 99999 7 -1 (Password set, SHA512 crypt.)

To set a password to expire in 30 days:

# passwd -x 30 uiraAdjusting aging data for user uira.passwd: Success

Note that the password expiration is now set to 30 days:

# passwd -S uirauira PS 2019-04-11 0 30 7 -1 (Password set, SHA512 crypt.)

Learn much more about Linux in our online course. You can enroll here. If you already have an account, or want to create one, just sign in or create your user here.

Liked it? Share