Linux Password Aging and Expiration Explained

Linux manages password aging and expiration to enforce security compliance by requiring users to update their credentials at regular intervals. This lifecycle is primarily governed by the /etc/shadow file, default policies set in /etc/login.defs, and administrative tools like the chage and passwd commands. During login, the Pluggable Authentication Modules (PAM) framework evaluates these parameters, notifying users of impending expiration or forcing an immediate credential change when limits are reached.

The Storage Backend: /etc/shadow

The system tracks password aging details in /etc/shadow. Each line represents a user account divided into nine colon-separated fields. Fields three through eight specifically control password aging:

1. Date of Last Change (Field 3): The date the password was last modified, represented as the number of days since the Unix Epoch (January 1, 1970).
2. Minimum Password Age (Field 4): The minimum number of days that must elapse before the user is permitted to change their password again. This prevents users from cycling through passwords rapidly to reuse an old one.
3. Maximum Password Age (Field 5): The maximum number of days a password remains valid. Once this threshold is crossed, the user must update their password.
4. Warning Period (Field 6): The number of days prior to password expiration during which the user receives a warning message upon logging in.
5. Inactivity Period (Field 7): The grace period (in days) after the maximum age expires before the account is fully locked.
6. Account Expiration Date (Field 8): An absolute date, expressed in days since the Epoch, on which the account itself is disabled, regardless of password status.

Global Defaults: /etc/login.defs

When new user accounts are created using utilities like useradd, the system applies default aging parameters defined in /etc/login.defs. Key directives include:

• PASS_MAX_DAYS: Sets the default maximum lifespan for new passwords.
• PASS_MIN_DAYS: Sets the default minimum duration before a password can be changed.
• PASS_WARN_AGE: Sets the default number of warning days before expiration.

Modifying /etc/login.defs affects only newly created accounts; existing accounts retain their current settings.

Managing Aging with the chage Command

The primary administrative tool for viewing and altering password aging policies for individual users is chage (change age).

• View Current Aging Policy:

  chage -l username

• Set Maximum Password Age:

  sudo chage -M 90 username

  (Sets password to expire every 90 days)
• Set Minimum Password Age:

  sudo chage -m 7 username

  (Requires passwords to be kept for at least 7 days)
• Set Warning Interval:

  sudo chage -W 14 username

  (Warns the user 14 days before expiration)
• Set Inactivity Grace Period:

  sudo chage -I 7 username

  (Locks the account 7 days after the password expires if unchanged)
• Force Immediate Password Reset:

  sudo chage -d 0 username

  (Sets the last change date to 0, forcing a change on the next login)

Alternative Management with passwd

The standard passwd utility also contains flags to adjust expiration settings:

• -x (Maximum Age): sudo passwd -x 90 username
• -n (Minimum Age): sudo passwd -n 7 username
• -w (Warning Days): sudo passwd -w 14 username
• -i (Inactivity Period): sudo passwd -i 7 username

Enforcement Through PAM

Enforcement occurs during authentication via PAM, specifically through modules like pam_unix.so. When a user authenticates via SSH, the graphical display manager, or a TTY console, PAM reads the corresponding entries in /etc/shadow.

If the current date exceeds the Date of Last Change + Maximum Age, PAM prompts the user to input their current password followed by a new password before granting shell access. If the grace period has also expired, PAM denies access entirely, requiring a system administrator to unlock the account.