2

I am using Red Hat Enterprise Linux 7.5 and have instances deployed in AWS. By default accounts are set to go "inactive" after 60 days also, which means an admin will have to unlock the account. I want to make sure this is foolproof to avoid everyone from getting permalocked out, including admins, as these hosts currently do not support LDAP (yet) and may be seldom logged onto. Is there a command/configuration file that by default disables the "Password inactive" setting? Functionality should be the same as chage -I -1 <username> but it's impractical to run that for every account on 3 dozen instances. I just want passwords to expire after 60 days which I have set in /etc/login.defs, but for the system to prompt users to change their password upon login after expiration. Currently it gives an authentication failure until an admin resets the password (chage -d 0 <username>).

Note that password expires designates when he password will no longer work and that password inactive designates when the account will be locked due to expiration (or something to that effect.

# chage -l myuser Last password change :Sep 19, 2018 Password expires :Nov 18, 2018 Password inactive :Nov 18, 2018 Account expires :never Minimum number of days between password change :1 Maxinum number of days between password change :60 Number of days of warning before password expires :7

1

The default is set in /etc/default/useradd, e.g.:

INACTIVE=-1

See man useradd for details.

Note that this will change the default for new accounts, but will not affect existing accounts. You will likely want to write a script to update this value for your existing users.

  • Interesting it's not part of the password setting conf file. But this is exactly what I need. – Greg Sep 26 '18 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.