In our previous guide, we have discussed on how to secure our passwords in Linux. In this tutorial, we will see how to manage passwords in our Linux system.

/etc/login.defs

The /etc/login.defs file contains some default settings for user passwords like password aging and length settings. (You will also find the numerical limits of user ids and group ids and whether or not a home directory should be created by default).

Debian also has this file.

Chage

The chage command can be used to set an expiration date for a user account (-E), set a minimum (-m) and maximum (-M) password age, a password expiration date, and set the number of warning days before the password expiration date. Much of this functionality is also available from the passwd command. The -l option of chage will list these settings for a user.

disabling a password

Passwords in /etc/shadow cannot begin with an exclamation mark. When the second field in /etc/passwd starts with an exclamation mark, then the password can not be used. Using this feature is often called locking, disabling, or suspending a user account. Besides vi (or vipw) you can also accomplish this with usermod. The first command in the next screenshot will show the hashed password of paul in /etc/ shadow. The next command disables the password of paul, making it impossible for paul to authenticate using this password.

The root user (and users with sudo rights on su) still will be able to su into the paul’s account (because the password is not needed here). Also note that paul will still be able to login if he has set up passwordless ssh!

You can unlock the account again with the following command.

# usermod -U paul

Watch out for tiny differences in the command line options of passwd, usermod, and useradd on different Linux distributions. Verify the local files when using features like “disabling, suspending, or locking” on user accounts and their passwords.

editing local files

If you still want to manually edit the /etc/passwd or /etc/shadow, after knowing these commands for password management, then use vipw instead of vi(m) directly. The vipw tool will do proper locking of the file.

#vipw /etc/passwd
Post Views: 2,408
The following two tabs change content below.

Ruwantha Nissanka

Ruwantha Nissanka is a Professional Cyber Security Engineer from Sri lanka with having a demonstrated history of providing cyber security services for multiple organizations in Sri Lanka. He is a positive person who wants to believe the best in others and he likes to help, encourage people and make them feel good.