I am using Red Hat Enterprise Linux 7.5 and have instances deployed in AWS. By default accounts are set to go "inactive" after 60 days also, which means an admin will have to unlock the account. I want to make sure this is foolproof to avoid everyone from getting permalocked out, including admins, as these hosts currently do not support LDAP (yet) and may be seldom logged onto. Is there a command/configuration file that by default disables the "Password inactive" setting? Functionality should be the same as
chage -I -1 <username> but it's impractical to run that for every account on 3 dozen instances. I just want passwords to expire after 60 days which I have set in /etc/login.defs, but for the system to prompt users to change their password upon login after expiration. Currently it gives an authentication failure until an admin resets the password (
chage -d 0 <username>).
password expires designates when he password will no longer work and that
password inactive designates when the account will be locked due to expiration (or something to that effect.
# chage -l myuser Last password change :Sep 19, 2018 Password expires :Nov 18, 2018 Password inactive :Nov 18, 2018 Account expires :never Minimum number of days between password change :1 Maxinum number of days between password change :60 Number of days of warning before password expires :7