What it does
chage (change age) sets how long a password is valid, when users get a warning, when an account is locked after the password expired, and when the whole account expires.
All values are in /etc/shadow. Without options (as root) chage asks for every value. Normal users may only list their own data with chage -l.
For new users, the defaults come from PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE in /etc/login.defs.
How to write it
chage [OPTION]... LOGINOptions 11
Most used
Nothing matches this filter.
Examples 12
$ run as a normal user# run as root (or with sudo)
1Show the aging data
chage -l lisa Last password change : Oct 25, 2026 Password expires : Jan 23, 2027 Password inactive : never Account expires : never Minimum number of days between password change : 1 Maximum number of days between password change : 90 Number of days of warning before password expires : 7Users can run
chage -lfor their own account.2Change every 90 days, warn 7 days before
chage -M 90 -W 7 lisaA common company rule.
3Let the account expire on a date
chage -E 2026-12-31 contractor1After this day the user cannot log in.
4Force a new password at the next login
chage -d 0 lisaGood after you gave a temporary password.
5Block an account at once
chage -E 0 olduserStops all logins, also SSH keys (better than passwd -l).
6Remove the expire date
chage -E -1 contractor1The account never expires.
7Lock the account 14 days after the password expired
chage -I 14 lisaA forgotten account gets locked by itself.
8Stop a user from changing back at once
chage -m 1 lisaWith a password history rule, users cannot cycle back to the old password.
9Ask for every value
chage lisaInteractive mode: press Enter to keep a value.
10Show dates in ISO format
chage -l -i lisa | head -2Easier to read in scripts.
11Find accounts without a max age (audit)
awk -F: '$2 ~ /^\$/ && ($5 == "" || $5 == 99999) {print $1}' /etc/shadowUsers with a password that never expires (check against your policy).
12Apply a rule to all normal users
for u in $(awk -F: '$3 >= 1000 && $3 < 60000 {print $1}' /etc/passwd); do chage -M 90 "$u"; donelogin.defs changes only affect new users; this changes the existing ones.
Nothing matches this filter.
Watch out
-Eis the account expire date;-Mis about the password. Do not mix them.- Changes in /etc/login.defs do not change existing users.
Files
/etc/shadow- The aging fields (fields 3 to 8).
/etc/login.defs- Defaults for new users.
Exit codes
0 | Done. |
1 | Permission denied. |
2 | Wrong syntax. |
15 | The shadow file is missing. |