Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my e-mail servers uses unix system accounts for user login. Because I didn't set up any complex password policies (our users, including management staff, don't like complicated passwords), one of the accounts, that had a dictionary 6 letter pasword, was hacked and a few thousand spams were sent. So, naturally, our IP ended up in 3 RBLs. After talking with the management, we decided that it was time to increase password complexity requirements. (minimum 8 characters, upper case, lower case, numbers, etc)

Now, here is the problem. How to make sure that all our users really change the password without having to check the logs, chage command output, etc? The best solution I could think of, was to set a 10 day password expiration for all users and then send a mass email to everyone, telling them that if they don't change their password, after 10 days they won't be able to login.

So I started doing tests, to see if this was a viable solution and I encountered a problem that I should have foreseen: Even though I set the password expiration to 10 days (chage -M 10 user), after changing the password, the expiration date remained the same, instead of returning to "never".

Is there some way of turning off password expiration after the user has changed it's password? (Users can change their password via the webmail interface, using a script based on chpasswd command).

share|improve this question

1 Answer 1

up vote 4 down vote accepted

I would try to combine chage -M and -d options.

-M

Set the maximum number of days during which a password is valid. When MAX_DAYS plus LAST_DAY is less than the current day, the user will be required to change his/her password before being able to use his/her account.

-d

Set the number of days since January 1st, 1970 when the password was last changed. The date may also be expressed in the format YYYY-MM-DD.

So given these options, decide how often you want your passwords to expire. Obviously you don't want them to expire every 10 days, so -M option should be set to a higher value.

To make your users change their passwords in next 10 days, set the -d (LAST_DAY) option to the value so that LAST_DAY + MAX_DAYS == TODAY + 10 DAYS.

This trick will allow you to make the password expiration date approach faster. Once the password is changed, next expiration date will be set based on the value specified with the -M option.

share|improve this answer
    
The problem is that I only want ONE password change and then have the "Password expires" value reverted back to "Never". This doesn't happen. When the user changes the password, the Password expires value doesn't change. –  Andy Aug 10 at 9:49
    
I would suggest to keep the password expiration period set to an appropriate value based on company's security policies. It's not a good approach to never change passwords. However, if you want the passwords to never expire, you can set MAX_DAYS to a very large value and when you are sure that all your users changed their passwords, disable password expiration altogether. If you set MAX_DAYS to something like 99999, then effectively password expiration will be disabled. –  girek Aug 10 at 10:00
    
I'm sorry but I don't think you understood what I want... MAX_DAYS is already set to 99999. I wanted to automate the process, in a way that, if the user changes the password, MAX_DAYS would automatically go back to 99999. I'm pretty sure you can't do this, but I had to ask. :) Anyway, I will write the solution, after I come up with one. –  Andy Aug 10 at 13:14
    
MAX_DAYS value never changes. Password expires if LAST_DAY + MAX_DAYS < TODAY. I'll give a hypothetical example to illustrate. MAX_DAYS = 200, LAST_DAY = 100, TODAY = 250. In this case you have 50 days to change your password, but you can set LAST_DAY to 60, and this will make your password to expire in 10 days. Once you change the password, LAST_DAY == TODAY and you again have 200 days to change your password. –  girek Aug 10 at 13:51
    
Wow, I think my brain is experiencing the "dumb sunday" syndrome. You are right! Your solution works perfectly. What I did: I set MAX_DAYS to 8000 (~ 22 years), I set LAST_DAY to 8303 (year 1992), so the password would expire on August 21st, 2014. After changing the password, of course, the new expire date changed to july 5th, 2036. Thank you very much for your patience ! :) –  Andy Aug 10 at 14:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.