2

Is there a way with either commands passwd or chage to force the password to expire 90 days from the time of command execution?

I know I can do it by date, such as:

chage -E "2014-07-31" userid

But I'm looking for a way to do it by with a number instead of a specific date.

Thank you!

3
  • chage -M 90 userid
    – Ramesh
    Mar 25, 2014 at 22:04
  • Doesn't that just change the the MAX number of days for that password to expire? From the man entry: -M, --maxdays MAX_DAYS Set the maximum number of days during which a password is valid. I'm pretty sure it doesn't actually reset the last time the password was changed. Mar 25, 2014 at 22:05
  • If it is a shell script, you can probably calculate 90 days from current date using date command and set the expiration using -E flag itself. If however, you need to specify the days, I see you have to change some files such as \etc\login.defs and etc\default\useradd.
    – Ramesh
    Mar 25, 2014 at 22:15

2 Answers 2

8

chage doesn't handle date differences by itself, but you can let the shell take care of that and give chage a number of days since 1970-01-01 instead of a YYYY-MM-DD date representation:

chage -E $(( $(date +%s)/3600/24 + 90 )) userid

(Replace 90 with any number of days.)


Changing the expiration date of the password rather than the account is a little trickier — in fact, you cannot set an actual expiration date for the password, just a maximum age (using chage -M).

To compute the maximum age required for the password to expire 90 days from now, we need to jump through a few more hoops:

userid=johndoe
pwd_age=$(grep "^$userid:" /etc/shadow | cut -d: -f 3)
now=$(( $(date +%s) / 3600 / 24 ))
age_at_expiry_date=$(( $now + 90 - $pwd_age ))
chage $userid -M $age_at_expiry_date

If you don't mind it being rather convoluted, you can even combine that into a one-liner:

userid=johndoe chage $userid -M $(( $(date +%s) / 3600 / 24 + 90 - $(grep "^$userid:" /etc/shadow | cut -d: -f 3) ))

If you don't mind overwriting the date when the password was last changed, you can just

chage -M 90 -d $(date +%F) userid
7
  • Thanks for your suggestion. I tried it, but it didn't really have the desired effect. Maybe I'm not expressing what I want correctly. Instead of updating the 'Password expires' field (see codechage -l useridcode), it updated the 'Account expires' field. Is this the expected behavior? Mar 26, 2014 at 14:12
  • @HEADLESS_0NE -E does indeed change the account expiration date, not the one of the password. I just assumed that's what you were trying to do since you used -E in your question. As for the password, you can't set an actual expiry date, just a maximum age (using -M, as Ramesh already pointed out).
    – n.st
    Mar 26, 2014 at 15:37
  • @HEADLESS_0NE I've updated my answer to include a solution for the password (rather than account) expiry.
    – n.st
    Mar 26, 2014 at 15:51
  • Thanks, this is a step in the right direction. I'm going to have to twiddle around, because I still want the "Maximum number of days between password change" to be 90 days. From what I understand, the password expiry date is computed based on the 'Last password change' and the 'Max number of days between password change'. So modifying the 'Last password change' to now somehow would resolve my issue altogether. I looked at /etc/shadow and the third column corresponds to "Last password change (lastchanged): Days since Jan 1, 1970 that password was last changed". Just need to modify that (?) Mar 26, 2014 at 19:40
  • Haha, I gave it a try and it had...unexpected consequences; it reset every field to never and -1. I guess Linux doesn't like me manipulating /etc/shadow directly. Mar 26, 2014 at 19:47
1

RHEL 6.8

#set passwd max no days = 30
passwd username -x30
1
  • That option seems to exist on Debian as well, so I suspect it's pretty universal on Linux (I have no idea if it does what OP asks for, though). Anyway, answers are much better with a little prose explaining them, not just a command to run. For example, you could change the comment to a sentence, and include a reference to the manpage.
    – derobert
    Dec 21, 2016 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .