Tuesday, April 1, 2008

How do I enforce user passwords to expire after a set amount of time?

To force users to change their passwords the maxdays variable has to be set for that user. An example of how to do this can be found below:

chage -M 30 The above will expire the associated users password every 30 days. This can also be done when first assigning a password to a user when creating their account with the command below: passwd -x 30
It would also be wise to warn your users that their account password is about to expire. This can be done by changing the warndays variable shown below.

chage -W 4 This will warn the user 4 days before their password expires that they will need to change their password.

To retrieve expiry information about an existing account, use the command below:

chage -l The above command will result in the output below: Minimum: 0
Maximum: 30
Warning: 4
Inactive: -1
Last Change: Mar 03, 2005
Password Expires: Apr 02, 2005
Password Inactive: Never
Account Expires: Never

Further information on all of the options for the chage and passwd commands can be foudn in the man pages. To view the manual page, issue the commands below at a terminal:

man chage
man passwd

0 comments: