How to Enforce Password Expiry Using the chage Command in Linux

Security policies in enterprise environments dictate that users must change their passwords regularly. If you are managing a Linux server with dozens of employee accounts, relying on users to voluntarily update their credentials is a massive security risk. Instead, system administrators must enforce strict password aging policies. To view, modify, and enforce mandatory password expiration dates on a Linux system, you should use the chage (change age) command.

How the chage Command Works

The chage utility directly modifies the user account aging information stored securely within the /etc/shadow file. It allows administrators to set a maximum number of days a password remains valid, provide advance warning before a password expires, and completely lock an account if the user fails to update their credentials in time.

Note: Because this command alters critical security configurations, almost all chage operations require sudo or root privileges.

Viewing Current Password Aging Information

Before you make any changes, it is best practice to review a user’s current password status. Use the -l (list) flag followed by the username to generate a human-readable report.

sudo chage -l jsmith

The output will display a clean summary, detailing the date the password was last changed, when the password will expire, and how many warning days the user will receive.

Last password change                                    : Jan 15, 2025
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7

Enforcing Password Expiration Rules

To secure an account, you can combine multiple flags into a single command to enforce a comprehensive aging policy.

• -M (Maximum days): Sets the maximum number of days a password is valid. After this threshold, the user must create a new password.
• -m (Minimum days): Sets the minimum number of days before a user is allowed to change their password again (prevents users from instantly changing their password back to the old one).
• -W (Warning days): Sets how many days in advance the user will receive a login warning that their password is about to expire.

For example, to enforce a strict corporate policy requiring the user jsmith to change their password every 90 days, with a 14-day advance warning, and preventing them from changing it more than once a week (7 days), you would run:

sudo chage -M 90 -m 7 -W 14 jsmith

Forcing an Immediate Password Reset

If you suspect an account has been compromised, or if you just created a new account with a generic temporary password, you can force the user to change their password the very next time they log in. To do this, set the “Last password change” date (-d) to zero.

sudo chage -d 0 jsmith

The next time jsmith attempts to access the server via SSH, the system will immediately halt the login process and prompt them to enter a new, secure password before granting them a shell session.