Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


So I set up a new Debian server and added some users for web space etc, the usual affair.

Skip forward 180 days and users start complaining their logins are not working. Given more than one person brought it up, I checked the auth logs and... BOOM. Failed logins due to password expiry. Dang!

Silly me had not considered the password expiry policy on this particular server.

Note, these users didn't have shell rights, but can login via sftp to manage their web space. So they wouldn't of been reminded about expiry or had the ability to change the password, even if they knew. From what I can tell, the error was only being logged server side. Client side it was a generic auth error.


How can I easily interrogate the server to get the password expiry info for all users?

Once I have that info, I can easily see which users are being effected and those which will be affected in the future.

share|improve this question
Did you do something to setup password expiration? On Debian accounts to not expire by default. – Zoredache Jul 28 '11 at 16:24
Hey, I guess it might of been a PAM enforcement, I'll have to check that. Perhaps it was the way in which the specific ways users added and the way PAM enforced certain rules. I recall setting up PAM fairly stringently. – Kyle Jul 28 '11 at 18:40
OK, so in the servers /etc/login.defs the following is true PASS_MAX_DAYS 180. This could well of been done as part of hardening guide I followed post install :) – Kyle Jul 28 '11 at 18:50
up vote 3 down vote accepted

A command like this should show you the expiration status for all accounts defined in your /etc/passwd.

cut -f 1 -d: /etc/passwd | xargs -n 1 -I {} bash -c " echo {} ; chage -l {}"

The important command is the chage -l username. That is the command that returns the expiration status for a user. Chage is also the command you would use to modify expiration rules.

share|improve this answer
Hey! Nice one for the answer. I found it most excellent. Did exactly what I needed and more. Also nice and short too! I'd been playing with this, what do you think? for user in $(cat /etc/passwd |cut -d: -f1); do expiry=$(chage -l $user | fgrep 'Password expires'); if ! echo $expiry | fgrep -q never; then echo -e "$user\t"$expiry; fi; done | column -t – Kyle Jul 28 '11 at 18:41
Thanks for helping me with the improved technique, this is what I'm going with: cut -f 1 -d: /etc/passwd | xargs -n 1 -I {} bash -c ' echo -n {}" "; chage -l {} | fgrep "Password expires"' | column -t – Kyle Jul 29 '11 at 9:31
Recently I also discovered the usefulness of passwd -S here is a nice one-liner cut -d: -f1 /etc/passwd | xargs -n1 -- passwd -S – Kyle Dec 6 '11 at 14:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.