We've created our user accounts so far, but as yet we haven't yet
set their passwords. Now passwords can be stored in the /etc/passwd
file, and traditionally they were, hence the name of the file, but
because we only have the one field, there is no option for aging or
adding shadow data.
If we store then our passwords inside of the etc/shadow file, we can
not only age the data, but we can add more security so it's not
readable by other users other than the root user.
When we look at the fields, we can take a look inside our
/etc/shadow file. We have the login name.
We then have the encrypted password.
The password will begin with an exclamation mark if the account is
locked or there is an invalid password that's configured.
We then got the date of the last password change, and that's going
to be the number of days after January 1, 1970.
The minimum password age, used often if we don't want a user to
quickly cycle through different passwords.
So if we set the minimum password age, let's say, to be 2
days, you can't change your passwords for 2 days after
you have already changed it.
Our maximum password age, though, is commonly set.
This is then how often we have to change our password.
Maybe we set it for something like 30 days or 40 days,
90 days, whatever works for your organization.
We can set a password warning, the number of days before your password
expires that you're going to get warnings when you log in, your password is
about to expire, would you like to change it now?
The password inactivity, the number of days after a password has expired
that the user can still log in using the old password.
So, for example, if we set this to 14 days,
if the user has been on holiday for a couple of weeks,
they can then come in after their 14 days holiday, so long as it's
still within that 14‑day period, and they're able then to log in
using their old password, but they're going to have to change
their password immediately.
We can set a day that the account will expire, and again,
this is normally going to be expressed as the number of
days after January 1, 1970.
All of this, though, is to do with the password.
It doesn't necessarily stop the user logging in.
If the user has another mechanism for authentication, such as
by using an SSH key or something like that, then they're
still going to be able to log in.
This is purely to do with our password data.
We can easily display this information with the
chage, change password aging command.
As an ordinary user, we can look at our own information, but we are
going to have to authenticate with our password.
The root user, as always though, should be able to
display anybody's information.
We're going to dive out to our command line in the next clip, where we're going to investigate a little bit about our user passwords.