Red Hat System Administration I

Instructions

1. From workstation, open an SSH session as the student user to the servera machine.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$

2. On servera, use the usermod command to lock and unlock the operator1 user.

   1. As the student user, use administrative rights to lock the operator1 account.

      [student@servera ~]$ sudo usermod -L operator1
      [sudo] password for student: student

   2. Try to log in as operator1. This command should fail.

      [student@servera ~]$ su - operator1
      Password: redhat
      su: Authentication failure

   3. Unlock the operator1 account.

      [student@servera ~]$ sudo usermod -U operator1

   4. Try to log in as operator1 again. This time, the command should succeed.

      [student@servera ~]$ su - operator1
      Password: redhat
      ...output omitted...
      [operator1@servera ~]$

   5. Log out of the operator1 user shell to return to the student user shell.

      [operator1@servera ~]$ exit
      logout

3. Change the password policy for the operator1 user to require a new password every 90 days. Confirm that the password age is successfully set.

   1. Switch to the root user.

      [student@servera ~]$ sudo -i
      [sudo] password for student: student
      [root@servera ~]#

   2. Set the maximum age of the operator1 user's password to 90 days.

      [root@servera ~]# chage -M 90 operator1

   3. Verify that the operator1 user's password expires 90 days after it is changed.

      [root@servera ~]# chage -l operator1
      Last password change      : Mar 10, 2022
      Password expires          : Jun 10, 2022
      Password inactive         : never
      Account expires           : never
      Minimum number of days between password change    : 0
      Maximum number of days between password change    : 90
      Number of days of warning before password expires : 7

4. Force a password change on the first login for the operator1 account.

   [root@servera ~]# chage -d 0 operator1

5. Exit as the root user from the servera machine.

   [root@servera ~]# exit
   logout
   [student@servera ~]$

6. Log in as operator1 and change the password to forsooth123. After setting the password, return to the student user's shell.

   1. Log in as operator1 and change the password to forsooth123 when prompted.

      [student@servera ~]$ su - operator1
      Password: redhat
      You are required to change your password immediately (administrator enforced)
      Current password: redhat
      New password: forsooth123
      Retype new password: forsooth123
      ...output omitted...
      [operator1@servera ~]$

   2. Exit the operator1 user's shell to return to the student user and then switch to the root user.

      [operator1@servera ~]$ exit
      logout
      [student@servera ~]$ sudo -i
      [sudo] password for student: student
      [root@servera ~]#

7. Set the operator1 account to expire 180 days from the current day.

   1. Determine a date 180 days in the future. Use the format %F with the date command to get the exact value. This returned date is an example; use the value on your system for the steps after this one.

      [root@servera ~]# date -d "+180 days" +%F
      2022-09-06

   2. Set the account to expire on the date that is displayed in the preceding step. For example:

      [root@servera ~]# chage -E 2022-09-06 operator1

   3. Verify that the account expiry date is successfully set.

      [root@servera ~]# chage -l operator1
      Last password change      : Mar 10, 2022
      Password expires          : Jun 10, 2022
      Password inactive         : never
      Account expires           : Sep 06, 2022
      Minimum number of days between password change    : 0
      Maximum number of days between password change    : 90
      Number of days of warning before password expires : 7

8. Set the passwords to expire 180 days from the current date for all users. Use administrative rights to edit the configuration file.

   1. Set PASS_MAX_DAYS to 180 in /etc/login.defs. Use administrative rights when you open the file with the text editor. You can use the vim /etc/login.defs command to perform this step.

      ...output omitted...
      # Password aging controls:
      #
      #       PASS_MAX_DAYS   Maximum number of days a password may be
      #       used.
      #       PASS_MIN_DAYS   Minimum number of days allowed between
      #       password changes.
      #       PASS_MIN_LEN    Minimum acceptable password length.
      #       PASS_WARN_AGE   Number of days warning given before a
      #       password expires.
      #
      PASS_MAX_DAYS 180
      PASS_MIN_DAYS   0
      PASS_WARN_AGE   7
      ...output omitted...

      Important

      The default password and account expiry settings apply to new users but not to existing users.

   2. Return to the workstation system as the student user.

      [root@servera ~]# exit
      logout
      [student@servera ~]$ exit
      logout
      Connection to servera closed.
      [student@workstation ~]$