Warn about password expiration without forcing change

Question

It's pretty simple. I would like to figure out what combination of changes in /etc/login.defs and/or /etc/pam.d/system-auth-ac. I would need to perform to allow the following behavior:

• I want a user's password to be valid for 60 days.

• After 60 days, the system needs to yell at the user when they log in, telling them they need to change their password ASAP.

• The system must not impede the user's access to the system.

• This must apply to existing users (non-system accounts, UID >=500) as well as any newly-created users.

Rationale: Limited users will not be managing the system account passwords, only system admin(s). Therefore, users should not have their access to the system impeded because the admin missed a password change. The number of accounts is rather small (maybe 9 or 10), but we're all human and we forget to do stuff from time to time.

I'm not sure if login.defs or PAM offer this. The documentation leads me to believe that you can either have the system force the user to change their password when it expires, or you can have the password not age at all. A third option is to have the password age limit set to some huge amount, like 9,999 days, and then start warning the user that their password will expire in 9,936 days, but that's not really what I need either. I've done other kinds of PAM configuration, so it's not my first trip around the block. I'm just stuck on this problem.

So, can this be done with PAM/login.defs, or do I need another utility that can take their place?

Answer 1

If you're not averse to using a custom script, try this as a pam_exec script:

#! /bin/bash
LAST_DATE=$(date -d "$(chage -l $PAM_USER  | awk -F: '/Last password/{print $2}')" '+%s')
TODAY=$(date '+%s')
MAX_AGE=60
if (( (($TODAY - $LAST_DATE) / 86400) > $MAX_AGE ))
then
    echo "Please change your password!"
fi

Save it somewhere (say, /usr/local/bin/pass-warn.sh), and add a line to /etc/pam.d/sshd:

session optional pam_exec.so stdout /usr/local/bin/pass-warn.sh

Answer 2

If you set password aging at all then pam_unix.so is going to deny their authentication after the password expires. To do what you're wanting you can probably add something to their login scripts. For example, I can add the following to /etc/profile.d:

#!/bin/bash
maxDays=30
dayLastChanged=$(passwd -S $(whoami) | awk '{print $3}')

currentTimestamp=$(date "+%s")
lastChangeTimestamp=$(date -d $dayLastChanged "+%s")

timestampDifference=$(( $currentTimestamp - $lastChangeTimestamp ))
maxSeconds=$(( $maxDays * 86400 ))

if [[ $timestampDifference -gt $maxSeconds ]]; then    
   echo "Yo, you need to change your password bud. Otherwise the guys with white-on-white ties are coming for you."    
fi