7 Examples to Manage Linux Password Expiration and Aging Using chage
# apt-get install chage
Note: It is very easy to make a typo on this command.
Instead of chage you may end up typing it as change. Please remember
chage stands for “change age”. i.e chage command abbreviation is similar
to chmod, chown etc.,
1. List the password and its related details for an user
As shown below, any user can execute the
chage command for himself to identify when his password is about to expire.
Syntax: chage –-list username (or) chage -l username
$ chage --list dhinesh
Last password change : Apr 01, 2009
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7
If user dhinesh tries to execute the same command for user ramesh, he’ll get the following permission denied message.
$ chage --list ramesh
chage: permission denied
Note: However, a root user can execute chage command for any user account.
When user dhinesh changes his password on Apr 23rd 2009, it will update the “Last password change” value as shown below.
Please refer to our earlier article: Best Practices and Ultimate Guide For Creating Super Strong Password, which will help you to follow the best practices while changing password for your account.
$ date
Thu Apr 23 00:15:20 PDT 2009
$ passwd dhinesh
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
$ chage --list dhinesh
Last password change : Apr 23, 2009
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7
2. Set Password Expiry Date for an user using chage option -M
Root user (system administrators) can set the password expiry date
for any user. In the following example, user dhinesh password is set to
expire 10 days from the last password change.
Please note that option -M will update both “Password expires” and
“Maximum number of days between password change” entries as shown below.
Syntax: # chage -M number-of-days username
# chage -M 10 dhinesh
# chage --list dhinesh
Last password change : Apr 23, 2009
Password expires : May 03, 2009
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 10
Number of days of warning before password expires : 7
3. Password Expiry Warning message during login
By default the number of days of warning before password expires is
set to 7. So, in the above example, when the user dhinesh tries to login
on Apr 30, 2009 — he’ll get the following message.
$ ssh dhinesh@testingserver
dhinesh@testingserver's password:
Warning: your password will expire in 3 days
4. User Forced to Change Password after Expiry Date
If the password expiry date reaches and user doesn’t change their
password, the system will force the user to change the password before
the login as shown below.
$ ssh dhinesh@testingserver
dhinesh@testingserver's password:
You are required to change your password immediately (password aged)
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for dhinesh
(current) UNIX password:
Enter new UNIX password:
Retype new UNIX password:
5. Set the Account Expiry Date for an User
You can also use chage command to set the account expiry date as
shown below using option -E. The date given below is in “YYYY-MM-DD”
format. This will update the “Account expires” value as shown below.
# chage -E "2009-05-31" dhinesh
# chage -l dhinesh
Last password change : Apr 23, 2009
Password expires : May 03, 2009
Password inactive : never
Account expires : May 31, 2009
Minimum number of days between password change : 0
Maximum number of days between password change : 10
Number of days of warning before password expires : 7
6. Force the user account to be locked after X number of inactivity days
Typically if the password is expired, users are forced to change it
during their next login. You can also set an additional condition, where
after the password is expired, if the user never tried to login for 10
days, you can automatically lock their account using option -I as shown
below. In this example, the “Password inactive” date is set to 10 days
from the “Password expires” value.
Once an account is locked, only system administrators will be able to unlock it.
# chage -I 10 dhinesh
# chage -l dhinesh
Last password change : Apr 23, 2009
Password expires : May 03, 2009
Password inactive : May 13, 2009
Account expires : May 31, 2009
Minimum number of days between password change : 0
Maximum number of days between password change : 10
Number of days of warning before password expires : 7
7. How to disable password aging for an user account
To turn off the password expiration for an user account, set the following:
- -m 0 will set the minimum number of days between password change to 0
- -M 99999 will set the maximum number of days between password change to 99999
- -I -1 (number minus one) will set the “Password inactive” to never
- -E -1 (number minus one) will set “Account expires” to never.
# chage -m 0 -M 99999 -I -1 -E -1 dhinesh
# chage --list dhinesh
Last password change : Apr 23, 2009
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7
