Passwords and Account Aging
One objective covering two things that look alike and are not: password expiry and account expiry. Every chage flag here is shown changing a specific field of /etc/shadow, so the file stops being a wall of colons - including the field that is a count of days since 1970 rather than a date.
Users and Groups Guide 18 of 67 Intermediate
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 15 min
RHEL 10 hashes with yescrypt - hashes begin $y$. Earlier releases used SHA-512 ($6$). The prefix is the algorithm id, and nothing in this guide depends on which one is in use.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this because two things here look alike and are not - expiring a password and expiring an account. This matters because there are three different ways to stop a login, and none of them are interchangeable.
- reading the shadow file field by field, and then the easy way
- setting the ageing policy with three flags
- separating account expiry from password expiry
- forcing a password change at next login
- comparing three different ways to stop a login, and what new accounts inherit
Before you start
- A sudo-capable account.
- The session creates and removes two accounts.
-
The shadow file, field by field
-
Reading it the easy way
-
Setting the policy
-
Expiring an account is not expiring a password
-
Forcing a change at next login
-
Three different ways to stop a login
-
What new accounts inherit