Bookmark this page

Guided Exercise: Managing User Password Aging

In this lab, you will set unique password policies for users.

Outcomes

The password for romeo must be changed when the user first logs into the system, every 90 days thereafter, and the account expires in 180 days.

Perform the following steps on serverX unless directed otherwise.

  1. Explore locking and unlocking accounts.

    1. Lock the romeo account.

      [student@serverX ~]$ sudo usermod -L romeo
    2. Attempt to log in as romeo.

      [student@serverX ~]$ su - romeo
      Password: romeo
      su: Authentication failure
      
    3. Unlock the romeo account.

      [student@serverX ~]$ sudo usermod -U romeo
  2. Change the password policy for romeo to require a new password every 90 days.

    [student@serverX ~]$ sudo chage -M 90 romeo
    [student@serverX ~]$ sudo chage -l romeo
    Last password change                                    : Feb 03, 2014
    Password expires                                        : May 04, 2014
    Password inactive                                       : never
    Account expires                                         : never
    Minimum number of days between password change          : 0
    Maximum number of days between password change          : 90
    Number of days of warning before password expires       : 7
    
  3. Additionally, force a password change on the first login for the romeo account.

    [student@serverX ~]$ sudo chage -d 0 romeo
    
  4. Log in as romeo and change the password to forsooth123.

    [student@serverX ~]$ su - romeo
    Password: romeo
    You are required to change your password immediately (root enforced)
    Changing password for romeo.
    (current) UNIX password: romeo
    New password: forsooth123 
    Retype new password: forsooth123 
    [romeo@serverX ~]$ exit
    
  5. Expire accounts in the future.

    1. Determine a date 180 days in the future.

      [student@serverX ~]$ date -d "+180 days"
      Sat Aug  2 17:05:20 EDT 2014
      
    2. Set accounts to expire on that date.

      [student@serverX ~]$ sudo chage -E 2014-08-02 romeo
      [student@serverX ~]$ sudo chage -l romeo
      Last password change                                    : Feb 03, 2014
      Password expires                                        : May 04, 2014
      Password inactive                                       : never
      Account expires                                         : Aug 02, 2014
      Minimum number of days between password change          : 0
      Maximum number of days between password change          : 90
      Number of days of warning before password expires       : 7
      
Revision: rh199-7-d0984a3