Password policy and account expiry
Domain 3 asks about account policy, and the commands are easy while the semantics are not. This guide shows that /etc/login.defs is read only when an account is created, ages an existing account with chage, and then separates the two expiries that people conflate - proving with a real key login that an expired ACCOUNT is refused by PAM while an expired PASSWORD is refused by something else entirely.
Security Guide 24 of 28 Intermediate
- OSAlmaLinux 10.2
- Kernel6.12.0-211.7.3.el10_2
- systemd257
- Mandatory access controlAppArmor on Ubuntu, SELinux enforcing on Alma
- TimeAbout 28 min
- Firewallufw / nftables 1.1.6 - firewalld / nftables 1.1.5
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| LPLUS-B01 | 192.168.0.74 | AlmaLinux 10.2 | RPM-family host - dnf, firewalld, NetworkManager, SELinux | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a policy has to apply to people who already have accounts, or when someone leaves and their access must actually stop. This matters because the obvious file does not do what it looks like it does, and because locking a password leaves a key login working.
- knowing that
login.defsapplies at account creation and never retroactively - setting ageing on an existing account with
chage -M -m -W - reading
chage -land the seven fields ofpasswd -S - telling account expiry from password expiry, by the exit code each produces
- using
chage -E 0as the control that stops an account with a working key - scoring a password against the live policy with
pwscore
Before you start
- accounts-sudo-and-what-a-login-reads
- the-ssh-server-and-what-blocks-a-login
-
The defaults, and the moment they are read
-
Changing the default, and who it does not reach
-
Changing an account that already exists
-
An expired account refuses a key that works
-
A password that must be changed, which is a different refusal
-
What makes a password acceptable
-
Putting the machine back