chage

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

chage (change age) sets how long a password is valid, when users get a warning, when an account is locked after the password expired, and when the whole account expires.

All values are in /etc/shadow. Without options (as root) chage asks for every value. Normal users may only list their own data with chage -l.

For new users, the defaults come from PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE in /etc/login.defs.

Zo schrijf je het

chage [OPTION]... LOGIN

Opties 11

Meest gebruikt

-l, --list: Show the aging data of the account.
-M, --maxdays DAYS: Maximum days a password is valid (-1 = no limit).
-m, --mindays DAYS: Minimum days between two changes (0 = any time).
-W, --warndays DAYS: Warn this many days before the password expires.
-I, --inactive DAYS: Lock the account this many days after the password expired (-1 = never).
-E, --expiredate DATE: The account expires on this date (YYYY-MM-DD, or days since 1970; -1 = never; 0 = expired now).
-d, --lastday DATE: Set the date of the last change (0 = the user must change the password at the next login).
-i, --iso8601: With -l: show dates as YYYY-MM-DD.
-R, --root DIR: Work in this chroot folder.
-P, --prefix DIR: Use the files under this prefix folder.
-h, --help: Show help.

Voorbeelden 12

$ als gewone gebruiker# als root (of met sudo)

1Show the aging data

#chage -l lisa
Last password change                                    : Oct 25, 2026
Password expires                                        : Jan 23, 2027
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 1
Maximum number of days between password change          : 90
Number of days of warning before password expires       : 7

Users can run chage -l for their own account.

2Change every 90 days, warn 7 days before
```
#chage -M 90 -W 7 lisa
```
A common company rule.
3Let the account expire on a date
```
#chage -E 2026-12-31 contractor1
```
After this day the user cannot log in.
4Force a new password at the next login
```
#chage -d 0 lisa
```
Good after you gave a temporary password.
5Block an account at once
```
#chage -E 0 olduser
```
Stops all logins, also SSH keys (better than passwd -l).
6Remove the expire date
```
#chage -E -1 contractor1
```
The account never expires.
7Lock the account 14 days after the password expired
```
#chage -I 14 lisa
```
A forgotten account gets locked by itself.
8Stop a user from changing back at once
```
#chage -m 1 lisa
```
With a password history rule, users cannot cycle back to the old password.
9Ask for every value
```
#chage lisa
```
Interactive mode: press Enter to keep a value.
10Show dates in ISO format
```
#chage -l -i lisa | head -2
```
Easier to read in scripts.
11Find accounts without a max age (audit)
```
#awk -F: '$2 ~ /^\$/ && ($5 == "" || $5 == 99999) {print $1}' /etc/shadow
```
Users with a password that never expires (check against your policy).
12Apply a rule to all normal users
```
#for u in $(awk -F: '$3 >= 1000 && $3 < 60000 {print $1}' /etc/passwd); do chage -M 90 "$u"; done
```
login.defs changes only affect new users; this changes the existing ones.

Let op

-E is the account expire date; -M is about the password. Do not mix them.
Changes in /etc/login.defs do not change existing users.

Bestanden

/etc/shadow: The aging fields (fields 3 to 8).
/etc/login.defs: Defaults for new users.

Exitcodes

`0`	Done.
`1`	Permission denied.
`2`	Wrong syntax.
`15`	The shadow file is missing.

`chage`

Wat het doet

Zo schrijf je het

Opties 11

Voorbeelden 12

1Show the aging data

2Change every 90 days, warn 7 days before

3Let the account expire on a date

4Force a new password at the next login

5Block an account at once

6Remove the expire date

7Lock the account 14 days after the password expired

8Stop a user from changing back at once

9Ask for every value

10Show dates in ISO format

11Find accounts without a max age (audit)

12Apply a rule to all normal users

Let op

Bestanden

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Opties 11

Voorbeelden 12

1Show the aging data

2Change every 90 days, warn 7 days before

3Let the account expire on a date

4Force a new password at the next login

5Block an account at once

6Remove the expire date

7Lock the account 14 days after the password expired

8Stop a user from changing back at once

9Ask for every value

10Show dates in ISO format

11Find accounts without a max age (audit)

12Apply a rule to all normal users

Let op

Bestanden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Gebruikt in deze labs

Volledige handleiding

`chage`