Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I prevent users from changing their passwords? I still want to be able to change the passwords as root if necessary but keep the user from changing their password.

share|improve this question
This question may be useful – yentup Feb 6 '13 at 0:55
Chmod the passwd command so that only you can execute it – Mawg Feb 6 '13 at 1:24
Why would you want to lower user security? – mdpc Feb 6 '13 at 2:40
@mdpc I don't. I plan on changing the password periodically, but I need it to be changed by me because it is a shared account and I don't want someone to change the password without the other people who have access being notified. – Vreality Feb 10 '13 at 1:17
up vote 5 down vote accepted

Do chmod go-rx /usr/bin/passwd Normal users can then not run passwd. If you want some users to be able to, you can put them in a special group perhaps.

share|improve this answer
Would this still work? cp /usr/bin/passwd . ; chmod +x ./passwd ; ./passwd – f.ardelian Jul 16 '13 at 16:00
@f.ardelian The thing is, passwd has some special magic called "setuid" on it - that means that when someone runs the file, they're running it as its owner (namely, root.) This allows normal users to change the /etc/shadow file containing the passwords. If you were to copy the file to a user's home directory, it would no longer be setuid, and therefore no longer be automatically run with root priviledges. To learn more, look up information about "Unix permissions" and "setuid". – JamesTheAwesomeDude Dec 7 '13 at 22:03
@JamesTheAwesomeDude Thanks, that was very informative! – f.ardelian Dec 8 '13 at 4:53

passwd -n 9999 user will prevent user from changing his password for almost 274 years.

If you want to have passwordless user, which is unable to change his password, open /etc/shadow as root, find the line which begins with the name of the user, and change the content between first and second colon to U6aMy0wojraho.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.