Password Management

Users forget passwords, accounts can be compromised, and sometimes access persists for people who should no longer have it. Without proper password and account lifecycle management, systems become vulnerable. This guide explains how Linux stores passwords, how to enforce password policies, how to set expiration rules, and how to lock or unlock accounts when needed. You’ll learn practical commands and where default settings come from so you can implement repeatable, auditable policies. What you’ll learn:

How Linux stores password data
Where default password policies are defined
How to inspect and change password aging for existing accounts
How to set account expiration and force password resets

How Linux stores passwords

Password hashes are stored in /etc/shadow. These are hashed values — not plaintext — to protect confidentiality.
Only privileged users (typically root) can read /etc/shadow.

The /etc/passwd file contains account metadata (username, UID, GID, shell, home directory) but not the password hashes; the hashes live in /etc/shadow, which has restricted permissions.

Default password policy for new accounts

When you create a new user, Linux assigns default password aging values from /etc/login.defs. This file controls:

Maximum password age (PASS_MAX_DAYS)
Minimum days between password changes (PASS_MIN_DAYS)
Minimum password length (PASS_MIN_LEN)
Warning period before password expiration (PASS_WARN_AGE)

Changing these values in /etc/login.defs affects users created after the change.

Managing existing accounts with chage

Use chage to view and modify password aging and account expiration for existing users. chage supports both non-interactive flags and an interactive prompt. Common chage usages are summarized below.

Option	Purpose	Example
`-d 0 user`	Force password change at next login by setting last change date to zero	`chage -d 0 user1`
`-M <days> user`	Set maximum number of days a password may be used	`chage -M 30 user1`
`-m <days> user`	Set minimum number of days between password changes	`chage -m 7 user1`
`-W <days> user`	Set number of days to warn before password expires	`chage -W 5 user1`
`-E YYYY-MM-DD user`	Set an account expiration date (account becomes inactive after this date)	`chage -E 2026-12-31 user1`
`-l user`	List a user’s password aging information	`chage -l user1`
`chage user`	Run interactive mode to be prompted for values	`chage user2`

Note: Regular users can change their own password with passwd. Only root can change other users’ passwords or change other users’ aging settings.

Quick reference: chage examples and expected output

Create user1, set a password, then configure aging:

# create user and set password (you will be prompted to type the password)
root@control:/home# useradd user1
root@control:/home# passwd user1
Changing password for user user1.
New password: redhat
Retype new password: redhat
passwd: all authentication tokens updated successfully.

Force a password change on next login and set aging policy:

root@control:/home# chage -d 0 user1
root@control:/home# chage -M 30 user1   # maximum password age = 30 days
root@control:/home# chage -m 7 user1    # minimum password age = 7 days
root@control:/home# chage -W 5 user1    # warn user 5 days before expiry
root@control:/home# chage -l user1
Last password change                                : password must be changed
Password expires                                    : password must be changed
Password inactive                                   : password must be changed
Account expires                                     : never
Minimum number of days between password change     : 7
Maximum number of days between password change     : 30
Number of days of warning before password expires  : 5
root@control:/home#

Set an account expiration date:

root@control:/home# chage -E 2026-12-31 user1
root@control:/home#

Interactive mode example

chage without flags enters interactive mode and prompts for values. This is useful for manual auditing and ad-hoc policy changes.

root@control:/home# useradd user2
root@control:/home# chage user2
Changing the aging information for user2
Enter the new value, or press ENTER for the default

    Minimum Password Age [0]: 4
    Maximum Password Age [99999]: 30
    Last Password Change (YYYY-MM-DD) [2026-04-20]:
    Password Expiration Warning [7]: 5
    Password Inactive [-1]:
    Account Expiration Date (YYYY-MM-DD) [-1]:
root@control:/home#

Where do the default values come from?

New-user defaults are taken from /etc/login.defs. Look for these parameters:

# Password aging controls:
#
#       PASS_MAX_DAYS    Maximum number of days a password may be used.
#       PASS_MIN_DAYS    Minimum number of days allowed between password changes.
#       PASS_MIN_LEN     Minimum acceptable password length.
#       PASS_WARN_AGE    Number of days warning given before a password expires.
#
PASS_MAX_DAYS   99999
PASS_MIN_DAYS   0
PASS_MIN_LEN    8
PASS_WARN_AGE   7

If you change PASS_MAX_DAYS to 30 in /etc/login.defs, any users created afterwards will inherit MAX_DAYS=30. Example: create user3 after changing defaults

root@control:/home# useradd user3
root@control:/home# chage -l user3
Last password change                : Apr 20, 2026
Password expires                    : May 20, 2026
Password inactive                   : never
Account expires                     : never
Minimum number of days between password change : 0
Maximum number of days between password change : 30
Number of days of warning before password expires : 7
root@control:/home#

This demonstrates that PASS_MAX_DAYS = 30 in /etc/login.defs was applied to the new account.

Best practices and operational notes

Only privileged users (root) can read /etc/shadow and modify other users’ password settings. Use least privilege for management tasks.
Use chage -l <user> regularly to audit user password aging configuration. Automate checks where possible.
Update /etc/login.defs to enforce default policies for accounts created in the future, and apply chage to existing accounts to make policies consistent across your environment.

Additional tips:

Require complex passwords and enforce minimum length (PASS_MIN_LEN) in /etc/login.defs or via PAM modules.
Combine expiration policies with account lockout rules from PAM (e.g., pam_faillock) to reduce brute-force risk.
Document policy changes and keep a change log for compliance requirements.

Recap

Password hashes are stored in /etc/shadow with restricted access.
Default password aging for new users is defined in /etc/login.defs.
Use chage to modify expiration rules and force password resets for existing users.
Use passwd for password changes; regular users can change their own password, while root can change any account’s password.
Combine /etc/login.defs, chage, PAM configuration, and auditing to enforce password policies and manage account lifecycle effectively.

Links and references

chage manual: https://man7.org/linux/man-pages/man1/chage.1.html
passwd manual: https://man7.org/linux/man-pages/man1/passwd.1.html
/etc/login.defs documentation and examples: /etc/login.defs on your system or distribution docs

With this knowledge, you should be comfortable managing password policies, expiration, and account lifecycle for Linux users.

Introduction

Working with the Command Line

File Management

Working with Text Files

Output Redirection

User Management

Linux Permissions

Enhanced Command Line

Storage Management

Managing Services

Controlling the Boot Process

Scheduling Future Tasks

Working with Logs

Installing Software

Process Management & Tuning

Managing Network Configuration and Security

SELinux

Configuring SSH

Password Management

How Linux stores passwords

Default password policy for new accounts

Managing existing accounts with chage

Quick reference: chage examples and expected output

Interactive mode example

Where do the default values come from?

Best practices and operational notes

Recap

Links and references

Watch Video

Practice Lab

​How Linux stores passwords

​Default password policy for new accounts

​Managing existing accounts with chage

​Quick reference: chage examples and expected output

​Interactive mode example

​Where do the default values come from?

​Best practices and operational notes

​Recap

​Links and references

Watch Video

Practice Lab

How Linux stores passwords

Default password policy for new accounts

Managing existing accounts with chage

Quick reference: chage examples and expected output

Interactive mode example

Where do the default values come from?

Best practices and operational notes

Recap

Links and references