passwd

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

A normal user runs passwd to change the own password (the old one is asked first). root can set the password of any user without knowing the old one, and can lock, unlock, delete or expire passwords.

The password is stored as a hash in /etc/shadow. PAM checks the quality of a new password (length, dictionary words) with the rules in /etc/security/pwquality.conf; root gets only a warning.

passwd also has short options for password aging (-x, -n, -w, -i); chage has the same and more.

Zo schrijf je het

passwd [OPTION]... [LOGIN]

Opties 17

Meest gebruikt

Set and change

-s, --stdin: Read the new password from standard input (root, for scripts).
-k, --keep-tokens: Change only if the password has expired.
-q, --quiet: Quiet mode.
-r, --repository REPOSITORY: Change the password in this repository.

Lock and status

-l, --lock: Lock the password (adds ! before the hash).
-u, --unlock: Unlock the password.
-d, --delete: Delete the password (empty password).
-e, --expire: Expire the password now: a new one is needed at the next login.
-S, --status: Show the password status of the account.
-a, --all: With -S: show the status of all users.

Aging

-x, --maxdays DAYS: Maximum number of days a password is valid.
-n, --mindays DAYS: Minimum number of days between changes.
-w, --warndays DAYS: Warn this many days before the password expires.
-i, --inactive DAYS: Lock the account this many days after the password expired.

Other

-R, --root DIR: Work in this chroot folder.
-P, --prefix DIR: Use the files under this prefix folder.
-h, --help: Show help.

Voorbeelden 12

$ als gewone gebruiker# als root (of met sudo)

1Change your own password
```
$passwd
Current password:
New password:
Retype new password:
```
The new password must pass the quality check.
2Set the password of another user
```
#passwd lisa
```
root does not need the old password.
3Set a password from a script
```
#echo 'S3cure#Pass' | passwd --stdin lisa
```
Fast for labs. In real scripts the password can end up in the shell history — use chpasswd from a protected file.
4Show the password status
```
#passwd -S lisa
lisa P 2026-10-25 0 90 7 -1
```
P = usable password, L = locked, NP = no password. Then last change, min, max, warn, inactive.
5Lock and unlock
```
#passwd -l lisa
#passwd -u lisa
```
A lock blocks password logins only, not SSH keys.
6Force a new password at the next login
```
#passwd -e lisa
```
Use it after you set a first password for a new person.
7Set password aging
```
#passwd -x 90 -n 1 -w 7 lisa
```
Same as chage -M 90 -m 1 -W 7 lisa.
8Check all accounts for weak states (security)
```
#passwd -Sa | awk '$2 == "NP"'
```
Accounts without a password are a big risk.
9Set many passwords at once
```
#chpasswd < /root/new-passwords.txt
```
File lines are user:password. Remove the file afterwards.
10Test the quality rules
```
#grep -E '^(minlen|minclass|dictcheck)' /etc/security/pwquality.conf
```
Set minlen = 12 to ask for longer passwords.
11Reset the root password from a rescue shell
```
#passwd root
```
In the rescue mode (rd.break or init=/bin/bash), see the boot chapter; then touch /.autorelabel.
12Delete a password (do not use on servers)
```
#passwd -d testuser
```
The account then has an empty password — only for special kiosk tests.

Let op

passwd -l does not stop SSH key logins. Use usermod -e 1 or chage -E 0 to block the account.
On RHEL 9 and older, passwd came from its own package with other long names (--maximum, --minimum); the short options are the same.

Bestanden

/etc/shadow: The password hashes and aging data.
/etc/security/pwquality.conf: Password quality rules.
/etc/pam.d/passwd: PAM rules for passwd.

Exitcodes

`0`	Done.
`1`	Permission denied.
`2`	Wrong option.
`3`	Unexpected failure, nothing done.
`4`	The password file is missing.
`5`	The password file is busy, try again.
`6`	Wrong argument.

`passwd`

Wat het doet

Zo schrijf je het

Opties 17

Set and change

Lock and status

Aging

Other

Voorbeelden 12

1Change your own password

2Set the password of another user

3Set a password from a script

4Show the password status

5Lock and unlock

6Force a new password at the next login

7Set password aging

8Check all accounts for weak states (security)

9Set many passwords at once

10Test the quality rules

11Reset the root password from a rescue shell

12Delete a password (do not use on servers)

Let op

Bestanden

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Opties 17

Set and change

Lock and status

Aging

Other

Voorbeelden 12

1Change your own password

2Set the password of another user

3Set a password from a script

4Show the password status

5Lock and unlock

6Force a new password at the next login

7Set password aging

8Check all accounts for weak states (security)

9Set many passwords at once

10Test the quality rules

11Reset the root password from a rescue shell

12Delete a password (do not use on servers)

Let op

Bestanden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Gebruikt in deze labs

Volledige handleiding

`passwd`