setting temporary password only expiration date

Question

• using RHEL 7.9, I have local user accounts defined in /etc/passwd and /etc/shadow.
• my password changing process is to email users, when needed, a temporary password.
• as root I do passwd <username> with that temporary password followed by a passwd -e <username> to expire that temporary password which will force that user to change it upon logging in via SSH.
• if I do chage -E <date> <username> I can set that temporary password to expire in say 7 days from the time I set that user account with a temporary password that I email them. However if the user does log in within that 7 days and successfully changes the password, that expiry date does not change; I wish it to only be in effect for that temporary password and go away after the user successfully changes it, is there a way to make this happen?
  • fyi I have PASS_MAX_DAYS = 90 in /etc/login.defs
  • if the user successfully changes their account password, I want the 8th (last) field in /etc/shadow to go empty, which corresponds to a chage -E -1 <username> and has nothing to do with PASS_MAX_DAYS.
  • I don't want the emailed temporary password to live for PASS_MAX_DAYS I want it to live only for 7 days; is there a way to make this happen automatically?

Answer 1

Set the inactivity timeout to 7 days (chage -I 7 <username>). This way:

• Since the password has expired (passwd -e), the user is forced to change their password when they log in.
• After 7 days, if the password has still not changed, the account becomes locked. This also disables non-password logins, but as far as I understand this is acceptable for you.

---

Please note that changing passwords often is bad practice. It used to be a popular (but misguided) recommendation a decade ago, but it's in fact counterproductive and is now largely deprecated. It pushes users to pick passwords that are easy to remember or to write them down in easily accessible places because they can't remember otherwise. Some major organizations used to require or recommend resetting passwords after 90 days, but . See:

• 2010 Microsoft paper
• 2010 UNC paper
• NCSC (formerly CESG) (2015)
• NIST (2017), summary

So I advise you to change your password policy, or if you can't do that, do let those in power know that they are perpetuating a known bad practice.