Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I set up password expiration policies for user accounts in Linux? Is it vastly different on each distribution?

In particular I use some Debian/Ubuntu servers, but links to appropriate info for other distros is obviously welcome.

[couldn't find a duplicate Q, but let me know]

share|improve this question

2 Answers 2

up vote 4 down vote accepted

I posted slightly quickly, it looks like both passwd and chage will work for what you would like to accomplish:

sudo chage [username] will interactively allow you to set things. Otherwise here is the help output of chage and passwd.

chage --help output: chage --help Usage: chage [options] [LOGIN]

Options:
  -d, --lastday LAST_DAY        set last password change to LAST_DAY
  -E, --expiredate EXPIRE_DATE  set account expiration date to EXPIRE_DATE
  -h, --help                    display this help message and exit
  -I, --inactive INACTIVE       set password inactive after expiration
                                to INACTIVE
  -l, --list                    show account aging information
  -m, --mindays MIN_DAYS        set minimum number of days before password
                                change to MIN_DAYS
  -M, --maxdays MAX_DAYS        set maximim number of days before password
                                change to MAX_DAYS
  -W, --warndays WARN_DAYS      set expiration warning days to WARN_DAYS

Output from command passwd --help -

passwd --help
Usage: passwd [options] [LOGIN]

Options:
  -a, --all                     report password status on all accounts
  -d, --delete                  delete the password for the named account
  -e, --expire                  force expire the password for the named account
  -h, --help                    display this help message and exit
  -k, --keep-tokens             change password only if expired
  -i, --inactive INACTIVE       set password inactive after expiration
                                to INACTIVE
  -l, --lock                    lock the named account
  -n, --mindays MIN_DAYS        set minimum number of days before password
                                change to MIN_DAYS
  -q, --quiet                   quiet mode
  -r, --repository REPOSITORY   change password in REPOSITORY repository
  -S, --status                  report password status on the named account
  -u, --unlock                  unlock the named account
  -w, --warndays WARN_DAYS      set expiration warning days to WARN_DAYS
  -x, --maxdays MAX_DAYS        set maximim number of days before password
                                change to MAX_DAYS
share|improve this answer
    
A more in-depth ubuntu document on the topic: help.ubuntu.com/9.04/serverguide/C/user-management.html –  sparks May 13 '09 at 17:19

You can set up expiration policies in /etc/login.defs - specifically PASS_MAX_DAYS=, PASS_MIN_DAYS= and PASS_WARN_AGE=

Also you need to edit /etc/default/useradd - INACTIVE= and EXPIRE=

It's not exactly the same situation, but there is more info here: http://serverfault.com/questions/3682/expiring-inactive-user-accounts

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.