We'll take a look now at managing user passwords.
So we've got the passwd command,
and we'll take a look at that, but also the differences
between different Linux distributions.
We've also got a way that we can script passwords across distributions
using chpasswd, so we'll take a look at that. And then look at if we do
change some of the defaults, how we can cater for system accounts where
passwords maybe don't expire.
The first thing that we're going to do is go through
and open up the /etc/login.defs file.
We looked at this before when we were changing some of the defaults for useradd.
When we look at this,
I can scroll down, and we can see that we've got our password aging information.
Maybe we want to start changing some of this, so maybe we
want to change our passwords every 90 days.
This is only effective where we're setting it here for
new passwords or new user accounts.
There is a password minimum days,
which is specifying the minimum number of days we must have
had a password before we can change it.
This is really to stop users cycling through passwords
very quickly. As we continue down,
we can see that we've got the password minimum length.
I'm going to keep this to 5, and our warning age,
we can get warned 7 days before our password expires.
Now that's enough for me now, so I'm going to save my changes. Now these
are just some of the defaults. As before, we do have our useradd defaults
for when we're creating brand‑new users.
If I go through and open up the /etc/default/useradd file again,
we can see that we've got a little bit of password‑aging information here. Here,
for example, the inactive period, specifying the number of days after
a password has expired that we are continuing being able to log in,
authenticate, with that expired password.
It's not set by default, it was ‑1, and we're going to configure it to 14 days.
So let's go through now and save these changes and then go and
create ourselves a brand‑new user account.
We can, of course, do that with our useradd command; we've already learned
that. Man! I like using commands we've already done.
We've already bagged this one.
So just using the default here, other than specifying that
we are going to create a user home directory, we've got our
brand‑new user account, u99.
If we want to set their password, we can do it using the echo command when
we're using RedHat‑based systems. I can send the information using the pipe
command through to passwd for u99, and read in the password through ‑‑stdin.
Now, his is great if we're using a RedHat‑based system such as CentOS,
AlmaLinux, or RedHat itself.
However, you don't have this option on Debian‑based systems.
So another way that we can set our passwords non‑interactively, so
we're not going to be prompted for the password, is to do it using
the chpasswd command. Again, we're using the echo command, but this
time we echo both the username and the Password, and it's just
colon separated.
We pipe that through to chpasswd, and obviously, we
don't need the user's password.
But now we've configured the user password, we're going to be able to see
their aging information using the chage command, ‑l to list for our user
account, u99. And look at this. We can see the password was changed, but the
password does expire on June 26. Two weeks after that, our password becomes
inactive where we can then no longer use our password for authentication, if
we haven't actually set our password by that date. We can see then again
confirmation further down that we do need to change our password every 90
days.
So everything is working the way that we would like it to work.
But maybe we've just realized as these settings now are being
set by default that this user account shouldn't have to
change their password information.
We can, of course, go through and modify that with chage as well,
where we can go through and set their maximum password age to be
99,999, the longest that it can be. We can set our minimum password
age, even though we hadn't configured that, but it's good to see it
from the command line to 0.
We can set an account expiry to never, although our account doesn't expire.
But what we do have is our inactive period.
We can make sure that's not set to July 10th anymore, but set
to ‑1, where we don't have our password being set to expire
after our password has been expired.
Now, as we go through and look for our u99, we can see then that we've got
a nice layout of all of our information with the correct information as we
need. So we can set these through the defaults, or we can change them individually using the chage command.