I'm looking to have Linux user account expire 7 days after the user logs in. Is there any solution aside from a custom-written script which checks and updates user accounts?

I have already looked at chage, /etc/login.defs, etc. Those tools allow you set set expiration based on the current date. I don't want the expiration count-down to begin until after the user has logged in for the first time.

  • Why do you want to do this? What is the business need that is being satisfied? I ask because your question looks lot like an XY problem.
    – MadHatter
    Jun 6, 2014 at 17:56
  • @MadHatter Perhaps. Our users are given shell accounts which expire after 7 days, but many do not log in right away. As an admin, it would be most convenient to generate their account and send it to them right away. Users expect the account to be valid for 7 days after they log in, not 7 days after account creation.
    – i_grok
    Jun 7, 2014 at 20:08
  • I take your point. But, assuming there's a security benefit to having the accounts expire after seven days (your call), why is that benefit not deemed to start until they log in? What problem are you trying to fix, here?
    – MadHatter
    Jun 8, 2014 at 0:38
  • It's not a question of security, but of total time allotted on the server. The business need is for users to have a maximum of 7 days on the system.
    – i_grok
    Jun 8, 2014 at 0:46
  • Then it seems the question of "starting when" is entirely a business, and not a technical, issue. Tell them they get seven days from now, and if they choose not to log in, that's their own problem.
    – MadHatter
    Jun 8, 2014 at 1:08

1 Answer 1


I really think you need a bit of scripting to do this. You could make it straightforward, by putting a special file in the users home directory, when the account is created e.g. .firsttime - then use this as a flag as to whether the user has logged in.

Then in the system-wide login profile, you test for the existence of the file, if its there, you could then touch a file in a root-owned directory with sticky-bit set and no execute (this would be to prevent users from seeing the file), and then remove the original file.

three lines of script added to /etc/profile.d e.g

if [ -e ~/.firsttime ]
  touch /tmp/firsttime/$USER
  rm ~/.firsttime

then a cron script, or manual script could set expire on the accounts listed. I would put a check in to make sure the ownership and filename match, to prevent someone from putting a "root" file there.

  • For anyone who comes back to this solution, the correct permissions for the /tmp/firsttime directory should be set with: chmod 1773 /tmp/firsttime
    – i_grok
    Jun 30, 2014 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.