I'm trying to configure users password policy on RHEL 6.6 and I want system to ask newly created users to change initial password on first login.
Note, that I tried to set EXPIRE variable to 0 and INACTIVE to -1 in /etc/default/useradd, but it leads to new user account expiration after creation. Output of chage command after user creation with these variables is:
# chage -l foo
Last password change : Feb 22, 2015
Password expires : May 23, 2015
Password inactive : never
Account expires : Feb 22, 2015
Minimum number of days between password change : 1
Maximum number of days between password change : 90
Number of days of warning before password expires : 7
When I try to login under foo user, message "Your account has expired. Please contact your system administrator" is shown.
But if I open 'User Properties' window, select 'Password Info' tab and check 'Force password change on next login', the result will be what I expect. New user will be asked to change password. Output of chage command in this case will be:
# chage -l foo2
Last password change : password must be changed
Password expires : password must be changed
Password inactive : password must be changed
Account expires : never
Minimum number of days between password change : 1
Maximum number of days between password change : 90
Number of days of warning before password expires : 7
When I login under foo2 user, system asks me to change password.
So, is there any way to configure system to set user account parameters on creation as in second case?
Upd
cat /etc/default/useradd
# useradd defaults file
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=0
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes
Even if I comment INACTIVE or set it to positive value, account is expired, but not a password.
Also, I configured PAM on machine.
Upd 2
I checked this on machine with RHEL 6.2 and without PAM configuration. Effect is the same.
chage -d 0 {user-name}
.EXPIRE=0
in/etc/default/useradd
should do the job. I read you tried. Can you add the uncommented lines of/etc/default/useradd
? It is locked even if you do not specify INACTIVE=-1, but a different value, or if you comment that line? Can you specify if accounts are locked even when created by command line. And, please, when you have a different question post it in a separate page if it will have diffent answer.adduser
lets you put thechage
command in/usr/local/sbin/adduser.local
. You can also set the age field in /etc/shadow to 0 directly.useradd
is the "low level utility," intended to be used in conjunction with other commands.