CertGrid CertGrid
Hands-on Lab·Linux Foundation Certified System Administrator

Passwords, ageing and locked accounts

Account expiry and password ageing are two different things stored in two different fields, and passwd -S reports a state that does not mean what it looks like. This guide reads the shadow fields directly, sets a policy with chage, and shows why locking an account that never had a password does not do what you expect.

Users and Groups Guide 20 of 38 Intermediate

shadow-utils, identical on both families. The default PASS_MAX_DAYS of 99999 means 'never' in practice and is the default on both.

Both families. The RHEL transcript came first, during an outage that took both Ubuntu hosts offline; the Ubuntu half was captured afterwards and is the last step of each page, because Ubuntu is what LFCS is most likely to sit you in front of.
Server NameIP AddressOSRolesCPURAMHDD
LFCS-A01192.168.0.70Ubuntu 26.04 LTSPrimary host - most guides run only here2 Core4 GB50 GB
LFCS-C01192.168.0.72AlmaLinux 10.2The other distribution - dnf, firewalld and NetworkManager2 Core4 GB50 GB

This guide includes

Use this because account expiry and password ageing are two different things kept in two different files. This matters because locking a password that does not exist behaves differently from locking one that does.

Before you start

  1. The ageing fields, and a date that is a number

  2. Setting a policy

  3. Forcing a change at the next login

  4. Locking a password that does not exist

  5. And locking one that does

  6. The same commands on Ubuntu

Official sources

← All LFCS guides