I'm trying to configure users password policy on RHEL 6.6 and I want system to ask newly created users to change initial password on first login.
Note, that I tried to set EXPIRE variable to 0 and INACTIVE to -1 in /etc/default/useradd, but it leads to new user account expiration after creation. Output of chage command after user creation with these variables is:
# chage -l foo Last password change : Feb 22, 2015 Password expires : May 23, 2015 Password inactive : never Account expires : Feb 22, 2015 Minimum number of days between password change : 1 Maximum number of days between password change : 90 Number of days of warning before password expires : 7
When I try to login under foo user, message "Your account has expired. Please contact your system administrator" is shown.
But if I open 'User Properties' window, select 'Password Info' tab and check 'Force password change on next login', the result will be what I expect. New user will be asked to change password. Output of chage command in this case will be:
# chage -l foo2 Last password change : password must be changed Password expires : password must be changed Password inactive : password must be changed Account expires : never Minimum number of days between password change : 1 Maximum number of days between password change : 90 Number of days of warning before password expires : 7
When I login under foo2 user, system asks me to change password.
So, is there any way to configure system to set user account parameters on creation as in second case?
cat /etc/default/useradd # useradd defaults file GROUP=100 HOME=/home INACTIVE=-1 EXPIRE=0 SHELL=/bin/bash SKEL=/etc/skel CREATE_MAIL_SPOOL=yes
Even if I comment INACTIVE or set it to positive value, account is expired, but not a password.
Also, I configured PAM on machine.
I checked this on machine with RHEL 6.2 and without PAM configuration. Effect is the same.