How to change user password → passwd
How to Change User Password → passwd
Table of Contents
1. [Introduction](#introduction)
2. [Prerequisites](#prerequisites)
3. [Understanding the passwd Command](#understanding-the-passwd-command)
4. [Basic Password Change Operations](#basic-password-change-operations)
5. [Advanced passwd Command Options](#advanced-passwd-command-options)
6. [Password Policy Configuration](#password-policy-configuration)
7. [Practical Examples and Use Cases](#practical-examples-and-use-cases)
8. [Security Best Practices](#security-best-practices)
9. [Troubleshooting Common Issues](#troubleshooting-common-issues)
10. [Administrative Password Management](#administrative-password-management)
11. [Conclusion](#conclusion)
Introduction
The `passwd` command is one of the most fundamental and essential utilities in Linux and Unix-like operating systems for managing user passwords. Whether you're a system administrator managing multiple user accounts or a regular user looking to update your own password, understanding how to properly use the `passwd` command is crucial for maintaining system security and user account management.
This comprehensive guide will walk you through everything you need to know about changing user passwords using the `passwd` command, from basic operations to advanced administrative functions. You'll learn about password policies, security best practices, troubleshooting common issues, and how to effectively manage passwords in both single-user and multi-user environments.
By the end of this article, you'll have a thorough understanding of password management in Linux systems and be equipped with the knowledge to handle various password-related scenarios confidently and securely.
Prerequisites
Before diving into password management with the `passwd` command, ensure you have the following:
System Requirements
- Access to a Linux or Unix-like operating system (Ubuntu, CentOS, RHEL, Debian, etc.)
- Terminal or command-line interface access
- Basic familiarity with command-line operations
User Permissions
- Regular users: Can change their own passwords
- Root/sudo users: Can change any user's password and manage password policies
- Appropriate permissions for the specific operations you intend to perform
Knowledge Prerequisites
- Basic understanding of Linux user accounts
- Familiarity with terminal navigation
- Understanding of file permissions (helpful but not mandatory)
Understanding the passwd Command
What is the passwd Command?
The `passwd` command is a system utility that allows users to change their password and administrators to manage password-related settings for user accounts. It interacts with the system's authentication mechanisms and updates password information stored in system files like `/etc/passwd` and `/etc/shadow`.
How passwd Works
When you execute the `passwd` command, it:
1. Authenticates the current user (except when run by root)
2. Prompts for the new password with confirmation
3. Validates the password against system policies
4. Encrypts the password using system-defined algorithms
5. Updates system files with the new password hash
6. Logs the password change in system logs
Command Syntax
The basic syntax of the `passwd` command is:
```bash
passwd [options] [username]
```
- No arguments: Changes the current user's password
- With username: Changes the specified user's password (requires appropriate privileges)
- With options: Modifies behavior or provides additional functionality
Basic Password Change Operations
Changing Your Own Password
The most common use of the `passwd` command is changing your own password. This operation is straightforward and requires only your current password for authentication.
Step-by-Step Process
1. Open your terminal or command-line interface
2. Execute the passwd command:
```bash
passwd
```
3. Enter your current password when prompted:
```
Changing password for username.
(current) UNIX password:
```
4. Enter your new password:
```
Enter new UNIX password:
```
5. Confirm your new password:
```
Retype new UNIX password:
```
6. Verify successful completion:
```
passwd: password updated successfully
```
Important Notes
- Password visibility: Passwords are not displayed on screen while typing (this is normal security behavior)
- Password strength: Most systems enforce minimum complexity requirements
- Immediate effect: Password changes take effect immediately
- Session continuity: Current login sessions remain active after password change
Changing Another User's Password (Administrative)
System administrators with root privileges or appropriate sudo access can change passwords for other users without knowing their current passwords.
Using Root Access
```bash
Switch to root user first
su -
Change password for specific user
passwd username
```
Using Sudo
```bash
Change password for specific user with sudo
sudo passwd username
```
Example: Changing Password for User "john"
```bash
sudo passwd john
```
Output:
```
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
```
Advanced passwd Command Options
Common Command-Line Options
The `passwd` command offers various options for different administrative and user scenarios:
Information and Status Options
```bash
Display password status information
passwd -S username
Example output:
john PS 2024-01-15 0 99999 7 -1 (Password set, SHA512 crypt.)
```
Status field meanings:
- L: Account is locked
- NP: Account has no password
- PS: Account has a usable password
Account Management Options
```bash
Lock a user account
sudo passwd -l username
Unlock a user account
sudo passwd -u username
Delete password (make account passwordless)
sudo passwd -d username
```
Password Expiration Options
```bash
Force password change on next login
sudo passwd -e username
Set password expiration (in days)
sudo passwd -x 90 username
Set minimum days between password changes
sudo passwd -n 7 username
Set warning days before password expires
sudo passwd -w 14 username
```
Batch Operations and Scripting
For administrative tasks involving multiple users, you can use `passwd` in scripts:
Non-Interactive Password Setting
```bash
Using echo and pipe
echo "newpassword" | sudo passwd --stdin username
Using chpasswd for batch operations
echo "username:newpassword" | sudo chpasswd
```
Script Example for Multiple Users
```bash
#!/bin/bash
Script to change passwords for multiple users
users=("alice" "bob" "charlie")
new_password="TempPass123!"
for user in "${users[@]}"; do
echo "$user:$new_password" | sudo chpasswd
echo "Password changed for user: $user"
done
```
Password Policy Configuration
Understanding Password Policies
Password policies define rules and requirements for password creation and management. These policies help maintain security standards across the system.
Common Password Requirements
Most Linux systems implement the following password requirements:
Length Requirements
- Minimum length: Typically 8-12 characters
- Maximum length: Usually 128+ characters (varies by system)
Complexity Requirements
- Mixed case: Upper and lowercase letters
- Numbers: At least one numeric character
- Special characters: Symbols like !@#$%^&*
- Dictionary words: Restrictions on common words
Historical Requirements
- Password history: Prevent reuse of recent passwords
- Minimum age: Time before password can be changed again
- Maximum age: Time before password must be changed
Configuring Password Policies
Using PAM (Pluggable Authentication Modules)
Edit the PAM configuration file for password policies:
```bash
sudo nano /etc/pam.d/common-password
```
Example configuration:
```
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1
```
Parameters explanation:
- `minlen=12`: Minimum password length of 12 characters
- `difok=3`: At least 3 characters different from old password
- `ucredit=-1`: Require at least 1 uppercase letter
- `lcredit=-1`: Require at least 1 lowercase letter
- `dcredit=-1`: Require at least 1 digit
- `ocredit=-1`: Require at least 1 special character
Password Aging Configuration
Edit `/etc/login.defs` for system-wide password aging:
```bash
sudo nano /etc/login.defs
```
Key settings:
```
PASS_MAX_DAYS 90 # Maximum password age
PASS_MIN_DAYS 1 # Minimum password age
PASS_WARN_AGE 7 # Warning days before expiration
```
Practical Examples and Use Cases
Scenario 1: New Employee Setup
When setting up a new employee account:
```bash
Create user account
sudo useradd -m -s /bin/bash newemployee
Set initial password
sudo passwd newemployee
Force password change on first login
sudo passwd -e newemployee
Set password expiration policy
sudo passwd -x 90 -n 1 -w 7 newemployee
```
Scenario 2: Security Incident Response
When responding to a potential security breach:
```bash
Lock all user accounts immediately
for user in $(cut -d: -f1 /etc/passwd | grep -v root); do
sudo passwd -l $user
done
Force password reset for specific users
sudo passwd -e compromised_user
Check password status
sudo passwd -S compromised_user
```
Scenario 3: Automated Password Reset
Script for automated password reset with email notification:
```bash
#!/bin/bash
Automated password reset script
USERNAME=$1
TEMP_PASSWORD=$(openssl rand -base64 12)
if [ -z "$USERNAME" ]; then
echo "Usage: $0 "
exit 1
fi
Reset password
echo "$USERNAME:$TEMP_PASSWORD" | sudo chpasswd
Force password change on next login
sudo passwd -e $USERNAME
Log the action
logger "Password reset for user $USERNAME"
echo "Temporary password for $USERNAME: $TEMP_PASSWORD"
echo "User must change password on next login"
```
Scenario 4: Password Policy Compliance Check
Script to check password policy compliance:
```bash
#!/bin/bash
Check password policy compliance
echo "Password Policy Compliance Report"
echo "================================="
Check password aging for all users
while IFS=: read -r username _ uid _ _ _ _; do
if [ $uid -ge 1000 ]; then
echo "User: $username"
passwd -S $username
chage -l $username | grep -E "(Last password change|Password expires)"
echo "---"
fi
done < /etc/passwd
```
Security Best Practices
Password Creation Guidelines
Strong Password Characteristics
- Length: Use passwords with at least 12-16 characters
- Complexity: Combine uppercase, lowercase, numbers, and symbols
- Uniqueness: Avoid reusing passwords across different accounts
- Unpredictability: Avoid patterns, personal information, or dictionary words
Password Generation Tools
Use system tools to generate secure passwords:
```bash
Generate random password using openssl
openssl rand -base64 16
Generate password using pwgen (if installed)
pwgen -s 16 1
Generate password using /dev/urandom
tr -dc A-Za-z0-9 Symptoms: Password change fails with authentication error
Causes and Solutions:
1. File system is read-only:
```bash
# Check file system status
mount | grep -E "(ro|read-only)"
# Remount as read-write
sudo mount -o remount,rw /
```
2. Insufficient disk space:
```bash
# Check disk space
df -h
# Clean up space or expand storage
```
3. Shadow file permissions:
```bash
# Check shadow file permissions
ls -l /etc/shadow
# Fix permissions if needed
sudo chmod 640 /etc/shadow
sudo chown root:shadow /etc/shadow
```
Issue: "Password does not meet complexity requirements"
Symptoms: New password is rejected during creation
Solutions:
1. Check password policy:
```bash
# View current policy
sudo cat /etc/pam.d/common-password | grep pam_pwquality
```
2. Test password strength:
```bash
# Test password against policy
echo "testpassword" | pwscore
```
3. Generate compliant password:
```bash
# Generate policy-compliant password
pwgen -s -y 16 1
```
Account Lock Issues
Issue: Account becomes locked after password attempts
Symptoms: User cannot login after failed password attempts
Solutions:
1. Check account status:
```bash
sudo passwd -S username
sudo pam_tally2 --user username
```
2. Unlock account:
```bash
# Unlock using passwd
sudo passwd -u username
# Reset failed login counter
sudo pam_tally2 --user username --reset
```
3. Prevent future lockouts:
```bash
# Configure account lockout policy
sudo nano /etc/pam.d/common-auth
# Adjust pam_tally2 settings
```
System Integration Issues
Issue: Password changes not synchronized across services
Symptoms: Password works for some services but not others
Solutions:
1. Restart authentication services:
```bash
sudo systemctl restart nscd
sudo systemctl restart sssd
```
2. Clear authentication cache:
```bash
sudo nscd -i passwd
sudo nscd -i group
```
3. Check service configurations:
```bash
# Verify NSS configuration
cat /etc/nsswitch.conf
# Check PAM configuration
ls -la /etc/pam.d/
```
Performance and Logging Issues
Issue: Slow password changes
Causes and Solutions:
1. High entropy generation:
```bash
# Check available entropy
cat /proc/sys/kernel/random/entropy_avail
# Install entropy daemon if needed
sudo apt-get install haveged
```
2. Network authentication delays:
```bash
# Check LDAP/AD connectivity
nslookup domain.controller
# Test authentication speed
time id username
```
Issue: Password changes not logged
Solutions:
1. Configure audit logging:
```bash
# Install auditd
sudo apt-get install auditd
# Add password change monitoring
sudo auditctl -w /etc/shadow -p wa -k password_changes
```
2. Check syslog configuration:
```bash
# Verify syslog is capturing auth events
sudo tail -f /var/log/auth.log
```
Administrative Password Management
Bulk Password Operations
Mass Password Reset
For situations requiring multiple password resets:
```bash
#!/bin/bash
Mass password reset script
USERLIST="users.txt" # File containing usernames
LOGFILE="/var/log/password_reset.log"
while read -r username; do
if id "$username" &>/dev/null; then
# Generate random password
new_pass=$(openssl rand -base64 12)
# Change password
echo "$username:$new_pass" | sudo chpasswd
# Force change on next login
sudo passwd -e "$username"
# Log the action
echo "$(date): Password reset for $username" >> "$LOGFILE"
echo "User: $username, Temp Password: $new_pass"
else
echo "User $username does not exist"
fi
done < "$USERLIST"
```
Password Expiration Management
Monitor and manage password expirations:
```bash
#!/bin/bash
Password expiration monitoring
echo "Users with passwords expiring soon:"
echo "===================================="
Check all users with UID >= 1000
while IFS=: read -r username _ uid _ _ _ _; do
if [ "$uid" -ge 1000 ]; then
# Get password expiration info
exp_info=$(chage -l "$username" 2>/dev/null)
exp_date=$(echo "$exp_info" | grep "Password expires" | cut -d: -f2 | xargs)
if [ "$exp_date" != "never" ] && [ "$exp_date" != "password must be changed" ]; then
# Calculate days until expiration
exp_epoch=$(date -d "$exp_date" +%s 2>/dev/null)
current_epoch=$(date +%s)
days_left=$(( (exp_epoch - current_epoch) / 86400 ))
if [ "$days_left" -le 7 ] && [ "$days_left" -ge 0 ]; then
echo "User: $username, Days left: $days_left, Expires: $exp_date"
fi
fi
fi
done < /etc/passwd
```
Integration with Configuration Management
Ansible Integration
Example Ansible playbook for password management:
```yaml
---
- name: Manage user passwords
hosts: all
become: yes
tasks:
- name: Change user password
user:
name: "{{ item.username }}"
password: "{{ item.password | password_hash('sha512') }}"
update_password: always
loop:
- { username: 'alice', password: 'newpassword123' }
- { username: 'bob', password: 'anotherpassword456' }
- name: Force password change on next login
shell: passwd -e {{ item.username }}
loop:
- { username: 'alice' }
- { username: 'bob' }
```
Puppet Integration
Puppet manifest for password management:
```puppet
Manage user passwords
define manage_user_password (
$username,
$password,
$force_change = true,
) {
user { $username:
ensure => present,
password => pw_hash($password, 'SHA-512', 'salt'),
}
if $force_change {
exec { "force_password_change_${username}":
command => "/usr/bin/passwd -e ${username}",
require => User[$username],
}
}
}
Usage
manage_user_password { 'alice':
username => 'alice',
password => 'temporarypassword',
force_change => true,
}
```
Monitoring and Reporting
Password Policy Compliance Report
```bash
#!/bin/bash
Generate password policy compliance report
REPORT_FILE="/tmp/password_compliance_report.txt"
DATE=$(date)
cat > "$REPORT_FILE" << EOF
Password Policy Compliance Report
Generated: $DATE
=====================================
EOF
echo "Checking password policies for all users..." >> "$REPORT_FILE"
echo "" >> "$REPORT_FILE"
Check each user account
while IFS=: read -r username _ uid _ _ _ _; do
if [ "$uid" -ge 1000 ]; then
echo "User: $username" >> "$REPORT_FILE"
echo "-------------" >> "$REPORT_FILE"
# Password status
passwd -S "$username" >> "$REPORT_FILE"
# Password aging info
chage -l "$username" | grep -E "(Last password change|Password expires|Password inactive|Account expires)" >> "$REPORT_FILE"
echo "" >> "$REPORT_FILE"
fi
done < /etc/passwd
echo "Report generated: $REPORT_FILE"
```
Conclusion
The `passwd` command is an essential tool for managing user passwords in Linux and Unix-like systems. Throughout this comprehensive guide, we've explored everything from basic password changes to advanced administrative functions, security best practices, and troubleshooting techniques.
Key Takeaways
1. Basic Operations: The `passwd` command provides straightforward password management for both individual users and administrators
2. Security Implementation: Proper password policies and complexity requirements are crucial for system security
3. Administrative Control: System administrators have extensive capabilities for managing user passwords and policies
4. Troubleshooting Skills: Understanding common issues and their solutions ensures smooth password management operations
5. Best Practices: Following security guidelines and implementing proper monitoring enhances overall system security
Next Steps
To further enhance your password management capabilities:
1. Implement Multi-Factor Authentication: Add additional security layers beyond passwords
2. Automate Password Policies: Use configuration management tools for consistent policy enforcement
3. Monitor Password Security: Implement regular audits and compliance checking
4. Integrate with Identity Management: Consider LDAP, Active Directory, or other centralized authentication systems
5. Stay Updated: Keep abreast of security best practices and emerging authentication technologies
Final Recommendations
- Always test password changes in a non-production environment first
- Maintain regular backups of authentication-related configuration files
- Document your password policies and procedures for consistency
- Train users on password security best practices
- Regularly review and update password policies based on current security standards
By mastering the `passwd` command and implementing the practices outlined in this guide, you'll be well-equipped to handle password management tasks securely and efficiently in any Linux environment. Remember that password security is an ongoing process that requires regular attention and updates to maintain effectiveness against evolving security threats.