If you are a Linux system administrator and you create a new account for a temporary employee or a new contractor, you will typically assign them a generic, temporary password (e.g., Welcome123!). However, relying on the user to voluntarily change that password to something secure is a massive security risk. Instead, you can use the passwd command to flag the account as expired, forcefully requiring the user to change their password the very first time they log in.
How to Force a Password Change
This process requires root privileges, so you must use the sudo command to execute the change.
- Open your Linux terminal.
- Assuming you have already created the user account (for example, a user named
johndoe) and assigned them their temporary password, type the following command:
sudo passwd -e johndoe
Press Enter. You will likely be prompted to enter your own administrator password to confirm the action.
What the Command Actually Does
The -e flag stands for “expire.” When you run this command, Linux immediately alters the user’s shadow file entry, changing the date of their last password modification to the “epoch” (January 1, 1970). Because this date is entirely in the past, the system’s security policies instantly recognize the password as severely expired.
The User Experience
The next time the user johndoe attempts to log into the system—whether via SSH, a graphical login screen, or an FTP client—the system will initially accept their generic Welcome123! password.
However, before granting them access to the bash shell or the desktop environment, the system will immediately halt the login process and display a strict prompt:
WARNING: Your password has expired. You must change your password now and login again!Changing password for johndoe.(current) UNIX password:
The user will be forced to type the temporary password one more time, and then they will be required to input a brand new, secure password twice to confirm it. If they refuse to complete this process, or if they close the terminal window, they will be denied access to the system entirely.