8

Context

So I set up a new Debian server and added some users for web space etc, the usual affair.

Skip forward 180 days and users start complaining their logins are not working. Given more than one person brought it up, I checked the auth logs and... BOOM. Failed logins due to password expiry. Dang!

Silly me had not considered the password expiry policy on this particular server.

Note, these users didn't have shell rights, but can login via sftp to manage their web space. So they wouldn't of been reminded about expiry or had the ability to change the password, even if they knew. From what I can tell, the error was only being logged server side. Client side it was a generic auth error.

Question

How can I easily interrogate the server to get the password expiry info for all users?

Once I have that info, I can easily see which users are being effected and those which will be affected in the future.

3
  • Did you do something to setup password expiration? On Debian accounts to not expire by default.
    – Zoredache
    Jul 28, 2011 at 16:24
  • Hey, I guess it might of been a PAM enforcement, I'll have to check that. Perhaps it was the way in which the specific ways users added and the way PAM enforced certain rules. I recall setting up PAM fairly stringently.
    – Kyle
    Jul 28, 2011 at 18:40
  • OK, so in the servers /etc/login.defs the following is true PASS_MAX_DAYS 180. This could well of been done as part of hardening guide I followed post install :)
    – Kyle
    Jul 28, 2011 at 18:50

2 Answers 2

8

A command like this should show you the expiration status for all accounts defined in your /etc/passwd.

cut -f 1 -d: /etc/passwd | xargs -n 1 -I {} bash -c " echo -e '\n{}' ; chage -l {}"

The important command is the chage -l username. That is the command that returns the expiration status for a user. Chage is also the command you would use to modify expiration rules. You may need to add sudo before chage depending on your system setup.

4
  • Hey! Nice one for the answer. I found it most excellent. Did exactly what I needed and more. Also nice and short too! I'd been playing with this, what do you think? for user in $(cat /etc/passwd |cut -d: -f1); do expiry=$(chage -l $user | fgrep 'Password expires'); if ! echo $expiry | fgrep -q never; then echo -e "$user\t"$expiry; fi; done | column -t
    – Kyle
    Jul 28, 2011 at 18:41
  • 1
    Thanks for helping me with the improved technique, this is what I'm going with: cut -f 1 -d: /etc/passwd | xargs -n 1 -I {} bash -c ' echo -n {}" "; chage -l {} | fgrep "Password expires"' | column -t
    – Kyle
    Jul 29, 2011 at 9:31
  • Recently I also discovered the usefulness of passwd -S here is a nice one-liner cut -d: -f1 /etc/passwd | xargs -n1 -- passwd -S
    – Kyle
    Dec 6, 2011 at 14:40
  • @Kyle sudo passwd -Sa
    – Walf
    Mar 28, 2017 at 7:26
1

You can use this simple command also:

awk -F':' '{ system("echo " $1 " && chage -l " $1) }' /etc/passwd

Using awk and system make it more simple.

1. awk -F':' here : is field seperator with /etc/passwd file as input.

2. system("echo " $1 " && chage -l " $1) this will first echo $1 and user's password expiry information with chage -l

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .