User accounts created on Red Hat Enterprise Linux (RHEL) servers are by default assigned 99,999 days until their password expires. The Center for Internet Security (CIS) provides some advice on controls for hardening systems, and one of these is setting password expirations to 365 days or less. The security team usually enforces this setting, but system administrators must ensure this is done.
Use the /etc/login.defs
file to set password aging policies. All new users inherit the definitions set in login.defs
. You'll use the chage
command to manage password-aging polices.
[ Free download: Advanced Linux commands cheat sheet. ]
In /etc/login.defs
, you can adjust the following parameters to reflect your security policy or control:
- PASS_MAX_DAYS: How many days the password is active before it expires.
- PASS_MIN_DAYS: How many days a password must be active before it can be changed by a user.
- PASS_WARN_AGE: The number of days a warning is issued to the user before an impending password expiry.
The following example modifies your policy such that a password expires after 90 days and cannot be changed until it's been active for seven days, and users are notified five days prior to password expiry:
PASS_MAX_DAYS 90
PASS_MIN_DAYS 7
PASS_WARN_AGE 5
Changes made to /etc/login.defs
affect only new users created on the system. For existing users, you must use the chage
command.
You can set the same configuration for existing users with:
$ sudo chage --mindays 7 \
--maxdays 90 --warndays 5 user1
View password age
To view the password age for a user, use the --list
option (-l
for short) with the chage
command. For example, to view password information for user1:
$ sudo chage --list user1
Minimum number of days between password change : 7
Maximum number of days between password change : 90
Number of days of warning before password expires: 5
Password expiry
Use the chage
command to set the expiry date for an account. This setting defines a given date, after which a user account is locked and inaccessible. You can do this with the --expiredate
(-E
for short) option.
For example, to cause the user1 account's password to expire after 90 days, count 90 days forward from the current date (July 15, 2022, in this example):
$ sudo chage -E 2022-07-15 user1
Alternately, use the date
command to do a calculation for you:
$ sudo chage --expiredate \
$(date -d +90days +%Y-%m-%d) user1
Password policies
A password policy is one important part of your organization's security posture. With the chage
command, you can make your systems manage password reminders and expiry dates reliably. Once the security team defines the appropriate settings, sysadmins can check that the settings are applied consistently.
[ Thinking about security? Check out this free guide to boosting hybrid cloud security and protecting your business. ]
Sobre el autor
I work as Unix/Linux Administrator with a passion for high availability systems and clusters. I am a student of performance and optimization of systems and DevOps. I have passion for anything IT related and most importantly automation, high availability, and security.
Más similar
Navegar por canal
Automatización
Las últimas novedades en la automatización de la TI para los equipos, la tecnología y los entornos
Inteligencia artificial
Descubra las actualizaciones en las plataformas que permiten a los clientes ejecutar cargas de trabajo de inteligecia artificial en cualquier lugar
Nube híbrida abierta
Vea como construimos un futuro flexible con la nube híbrida
Seguridad
Vea las últimas novedades sobre cómo reducimos los riesgos en entornos y tecnologías
Edge computing
Conozca las actualizaciones en las plataformas que simplifican las operaciones en el edge
Infraestructura
Vea las últimas novedades sobre la plataforma Linux empresarial líder en el mundo
Aplicaciones
Conozca nuestras soluciones para abordar los desafíos más complejos de las aplicaciones
Programas originales
Vea historias divertidas de creadores y líderes en tecnología empresarial
Productos
- Red Hat Enterprise Linux
- Red Hat OpenShift
- Red Hat Ansible Automation Platform
- Servicios de nube
- Ver todos los productos
Herramientas
- Training y Certificación
- Mi cuenta
- Soporte al cliente
- Recursos para desarrolladores
- Busque un partner
- Red Hat Ecosystem Catalog
- Calculador de valor Red Hat
- Documentación
Realice pruebas, compras y ventas
Comunicarse
- Comuníquese con la oficina de ventas
- Comuníquese con el servicio al cliente
- Comuníquese con Red Hat Training
- Redes sociales
Acerca de Red Hat
Somos el proveedor líder a nivel mundial de soluciones empresariales de código abierto, incluyendo Linux, cloud, contenedores y Kubernetes. Ofrecemos soluciones reforzadas, las cuales permiten que las empresas trabajen en distintas plataformas y entornos con facilidad, desde el centro de datos principal hasta el extremo de la red.
Seleccionar idioma
Red Hat legal and privacy links
- Acerca de Red Hat
- Oportunidades de empleo
- Eventos
- Sedes
- Póngase en contacto con Red Hat
- Blog de Red Hat
- Diversidad, igualdad e inclusión
- Cool Stuff Store
- Red Hat Summit