 Show
By , Unix Dweeb, Network World | With proper settings, Linux users can be forced to periodically change their passwords. Here's how to view password aging settings and how to configure some of the settings.
User passwords on Linux systems can be configured to be permanent or can be set to expire so that individuals must reset them periodically. Periodic password changing is generally considered good practice for security reasons, but is not configured by default. To view and modify password-aging settings, you need to be familiar with a couple important commands – the chage command along with its -l option and the passwd command with its -S. These commands, along with a few other chage commands that are used to configure password aging are described in this post. Viewing password aging settingsThe way to determine if password aging is in place for some particular account is to use the chage command as shown below. Note that root authority is needed to check any account other than your own. Notice the password expiration date below. $ sudo chage -l dory Last password change : Mar 15, 2020 Password expires : Jun 13, 2020 <== Password inactive : never Account expires : never Minimum number of days between password change : 10 Maximum number of days between password change : 90 Number of days of warning before password expires : 14If password aging is not being applied, the account information would look like this: $ sudo chage -l nemo Last password change : Jan 14, 2019 Password expires : never <== Password inactive : never Account expires : Mar 26, 2706989 Minimum number of days between password change : 0 Maximum number of days between password change : 99999 Number of days of warning before password expires : 7You can also view some of this information using the passwd -S command, but you'll need to know what each of the fields in the output represents: dory$ passwd -S dory P 03/15/2020 10 90 14 -1The seven fields here represent:
One interesting thing to note is that the chage command doesn’t show you if an account is locked; it only shows the password aging settings. The passwd -S command, on the other hand, will tell you when a password is locked. In this example, note that the account status is “L”: $ sudo passwd -S dorothy dorothy L 07/09/2019 0 99999 7 10This locking takes effect in the /etc/shadow file with the field that normally contains the password "hash" field becoming just a "!". $ sudo grep dorothy /etc/shadow dorothy:!:18086:0:99999:7:10:: <==That fact that an account is locked is not obvious in the chage output: $ sudo chage -l dorothy Last password change : Jul 09, 2019 Password expires : never Password inactive : never Account expires : never Minimum number of days between password change : 0 Maximum number of days between password change : 99999 Number of days of warning before password expires : 7Some options for password agingThe most commonly used settings are for the minimum and maximum days. These are often used in combination. For example, you might configure a password so that it cannot be used for more than 90 days (maximum) and then add that it cannot be changed before it has been in effect for a week or 10 days (minimum days). This ensures that users won’t change a password when required and then immediately change it back to what it was previously. $ sudo chage -M 90 -m 10 shark $ sudo chage -l shark Last password change : Mar 16, 2020 Password expires : Jun 14, 2020 Password inactive : never Account expires : never Minimum number of days between password change : 10 <== Maximum number of days between password change : 90 <== Number of days of warning before password expires : 7You can also set a specific expiration date for an account using the -E option. $ sudo chage -E 2020-11-11 tadpole $ sudo chage -l tadpole Last password change : Oct 15, 2019 Password expires : never Password inactive : never Account expires : Nov 11, 2020 <== Minimum number of days between password change : 0 Maximum number of days between password change : 99999 Number of days of warning before password expires : 7Password aging can be an important option as long as it doesn't encourage users to use passwords that are way too simple or write them down in insecure ways. For more information on controlling the character of passwords (e.g., combinations of uppercase and lowercase letters, digits, etc.), check out this post on password complexity. Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind. Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders. Copyright © 2020 IDG Communications, Inc. What is the minimum number of days that must pass before the password can be changed?Password age
Previous NIST guidelines recommended forcing users to change passwords every 90 days (180 days for passphrases).
Which chage option sets the minimum number of days a user must keep a password?To change the number of days which must be elapsed before user is allowed to change his password again, use -m option with chage command. For example, following command sets the minimum number of days between password changes to 5 days for user rick.
What is the minimum number of days that must pass before the password can be changed Linux?Typically if the password is expired, users are forced to change it during their next login. You can also set an additional condition, where after the password is expired, if the user never tried to login for 6 days, you can automatically lock their account using option -I as shown below.
How do I set the minimum length of a password?Navigate to Computer configuration > Windows settings > Security settings > Account policies > Password policy. Once here, locate the setting “Minimum Password Length” and double-click on it. From the properties menu that opens, type in the minimum password length you want to apply and click “OK” when you finish.
|
