> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Password Management
> Guide on Linux password storage, default policies, and account lifecycle management using /etc/shadow, /etc/login.defs, chage and passwd to enforce expiration and security.
Users forget passwords, accounts can be compromised, and sometimes access persists for people who should no longer have it. Without proper password and account lifecycle management, systems become vulnerable.
This guide explains how Linux stores passwords, how to enforce password policies, how to set expiration rules, and how to lock or unlock accounts when needed. You'll learn practical commands and where default settings come from so you can implement repeatable, auditable policies.
What you'll learn:
* How Linux stores password data
* Where default password policies are defined
* How to inspect and change password aging for existing accounts
* How to set account expiration and force password resets
***
## How Linux stores passwords
* Password hashes are stored in `/etc/shadow`. These are hashed values — not plaintext — to protect confidentiality.
* Only privileged users (typically `root`) can read `/etc/shadow`.
The `/etc/passwd` file contains account metadata (username, UID, GID, shell, home directory) but not the password hashes; the hashes live in `/etc/shadow`, which has restricted permissions.
***
## Default password policy for new accounts
When you create a new user, Linux assigns default password aging values from `/etc/login.defs`. This file controls:
* Maximum password age (`PASS_MAX_DAYS`)
* Minimum days between password changes (`PASS_MIN_DAYS`)
* Minimum password length (`PASS_MIN_LEN`)
* Warning period before password expiration (`PASS_WARN_AGE`)
Changing these values in `/etc/login.defs` affects users created after the change.
***
## Managing existing accounts with chage
Use `chage` to view and modify password aging and account expiration for existing users. `chage` supports both non-interactive flags and an interactive prompt.
Common `chage` usages are summarized below.
| Option | Purpose | Example |
| - | - | - |
| `-d 0 user` | Force password change at next login by setting last change date to zero | `chage -d 0 user1` |
| `-M user` | Set maximum number of days a password may be used | `chage -M 30 user1` |
| `-m user` | Set minimum number of days between password changes | `chage -m 7 user1` |
| `-W user` | Set number of days to warn before password expires | `chage -W 5 user1` |
| `-E YYYY-MM-DD user` | Set an account expiration date (account becomes inactive after this date) | `chage -E 2026-12-31 user1` |
| `-l user` | List a user's password aging information | `chage -l user1` |
| `chage user` | Run interactive mode to be prompted for values | `chage user2` |
Note: Regular users can change their own password with `passwd`. Only `root` can change other users' passwords or change other users' aging settings.
***
## Quick reference: chage examples and expected output
Create `user1`, set a password, then configure aging:
```bash theme={null}
# create user and set password (you will be prompted to type the password)
root@control:/home# useradd user1
root@control:/home# passwd user1
Changing password for user user1.
New password: redhat
Retype new password: redhat
passwd: all authentication tokens updated successfully.
```
Force a password change on next login and set aging policy:
```bash theme={null}
root@control:/home# chage -d 0 user1
root@control:/home# chage -M 30 user1 # maximum password age = 30 days
root@control:/home# chage -m 7 user1 # minimum password age = 7 days
root@control:/home# chage -W 5 user1 # warn user 5 days before expiry
root@control:/home# chage -l user1
Last password change : password must be changed
Password expires : password must be changed
Password inactive : password must be changed
Account expires : never
Minimum number of days between password change : 7
Maximum number of days between password change : 30
Number of days of warning before password expires : 5
root@control:/home#
```
Set an account expiration date:
```bash theme={null}
root@control:/home# chage -E 2026-12-31 user1
root@control:/home#
```
***
## Interactive mode example
`chage` without flags enters interactive mode and prompts for values. This is useful for manual auditing and ad-hoc policy changes.
```bash theme={null}
root@control:/home# useradd user2
root@control:/home# chage user2
Changing the aging information for user2
Enter the new value, or press ENTER for the default
Minimum Password Age [0]: 4
Maximum Password Age [99999]: 30
Last Password Change (YYYY-MM-DD) [2026-04-20]:
Password Expiration Warning [7]: 5
Password Inactive [-1]:
Account Expiration Date (YYYY-MM-DD) [-1]:
root@control:/home#
```
***
## Where do the default values come from?
New-user defaults are taken from `/etc/login.defs`. Look for these parameters:
```conf theme={null}
# Password aging controls:
#
# PASS_MAX_DAYS Maximum number of days a password may be used.
# PASS_MIN_DAYS Minimum number of days allowed between password changes.
# PASS_MIN_LEN Minimum acceptable password length.
# PASS_WARN_AGE Number of days warning given before a password expires.
#
PASS_MAX_DAYS 99999
PASS_MIN_DAYS 0
PASS_MIN_LEN 8
PASS_WARN_AGE 7
```
If you change `PASS_MAX_DAYS` to `30` in `/etc/login.defs`, any users created afterwards will inherit `MAX_DAYS=30`.
Example: create `user3` after changing defaults
```bash theme={null}
root@control:/home# useradd user3
root@control:/home# chage -l user3
Last password change : Apr 20, 2026
Password expires : May 20, 2026
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 30
Number of days of warning before password expires : 7
root@control:/home#
```
This demonstrates that `PASS_MAX_DAYS = 30` in `/etc/login.defs` was applied to the new account.
***
## Best practices and operational notes
* Only privileged users (root) can read `/etc/shadow` and modify other users' password settings. Use least privilege for management tasks.
* Use `chage -l ` regularly to audit user password aging configuration. Automate checks where possible.
* Update `/etc/login.defs` to enforce default policies for accounts created in the future, and apply `chage` to existing accounts to make policies consistent across your environment.
Additional tips:
* Require complex passwords and enforce minimum length (`PASS_MIN_LEN`) in `/etc/login.defs` or via PAM modules.
* Combine expiration policies with account lockout rules from PAM (e.g., `pam_faillock`) to reduce brute-force risk.
* Document policy changes and keep a change log for compliance requirements.
***
## Recap
* Password hashes are stored in `/etc/shadow` with restricted access.
* Default password aging for new users is defined in `/etc/login.defs`.
* Use `chage` to modify expiration rules and force password resets for existing users.
* Use `passwd` for password changes; regular users can change their own password, while `root` can change any account's password.
* Combine `/etc/login.defs`, `chage`, PAM configuration, and auditing to enforce password policies and manage account lifecycle effectively.
***
## Links and references
* chage manual: [https://man7.org/linux/man-pages/man1/chage.1.html](https://man7.org/linux/man-pages/man1/chage.1.html)
* passwd manual: [https://man7.org/linux/man-pages/man1/passwd.1.html](https://man7.org/linux/man-pages/man1/passwd.1.html)
* /etc/login.defs documentation and examples: `/etc/login.defs` on your system or distribution docs
With this knowledge, you should be comfortable managing password policies, expiration, and account lifecycle for Linux users.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.