3

I am using Red Hat Enterprise Linux 7.5 and have instances deployed in AWS. By default accounts are set to go "inactive" after 60 days also, which means an admin will have to unlock the account. I want to make sure this is foolproof to avoid everyone from getting permalocked out, including admins, as these hosts currently do not support LDAP (yet) and may be seldom logged onto. Is there a command/configuration file that by default disables the "Password inactive" setting? Functionality should be the same as chage -I -1 <username> but it's impractical to run that for every account on 3 dozen instances. I just want passwords to expire after 60 days which I have set in /etc/login.defs, but for the system to prompt users to change their password upon login after expiration. Currently it gives an authentication failure until an admin resets the password (chage -d 0 <username>).

Note that password expires designates when he password will no longer work and that password inactive designates when the account will be locked due to expiration (or something to that effect.

# chage -l myuser Last password change :Sep 19, 2018 Password expires :Nov 18, 2018 Password inactive :Nov 18, 2018 Account expires :never Minimum number of days between password change :1 Maxinum number of days between password change :60 Number of days of warning before password expires :7

Improve this question

1 Answer 1

Reset to default
1

The default is set in /etc/default/useradd, e.g.:

INACTIVE=-1

See man useradd for details.

Note that this will change the default for new accounts, but will not affect existing accounts. You will likely want to write a script to update this value for your existing users.

Improve this answer
1
  • Interesting it's not part of the password setting conf file. But this is exactly what I need.
    – Greg
    Sep 26, 2018 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .