11

I'm trying to configure users password policy on RHEL 6.6 and I want system to ask newly created users to change initial password on first login.

Note, that I tried to set EXPIRE variable to 0 and INACTIVE to -1 in /etc/default/useradd, but it leads to new user account expiration after creation. Output of chage command after user creation with these variables is:

 # chage -l foo
 Last password change                                : Feb 22, 2015
 Password expires                                    : May 23, 2015
 Password inactive                                   : never
 Account expires                                     : Feb 22, 2015
 Minimum number of days between password change      : 1
 Maximum number of days between password change      : 90
 Number of days of warning before password expires   : 7

When I try to login under foo user, message "Your account has expired. Please contact your system administrator" is shown.

But if I open 'User Properties' window, select 'Password Info' tab and check 'Force password change on next login', the result will be what I expect. New user will be asked to change password. Output of chage command in this case will be:

 # chage -l foo2
 Last password change                                : password must be changed
 Password expires                                    : password must be changed
 Password inactive                                   : password must be changed
 Account expires                                     : never
 Minimum number of days between password change      : 1
 Maximum number of days between password change      : 90
 Number of days of warning before password expires   : 7

When I login under foo2 user, system asks me to change password.

So, is there any way to configure system to set user account parameters on creation as in second case?

Upd

 cat /etc/default/useradd
 # useradd defaults file
 GROUP=100
 HOME=/home
 INACTIVE=-1
 EXPIRE=0
 SHELL=/bin/bash
 SKEL=/etc/skel
 CREATE_MAIL_SPOOL=yes

Even if I comment INACTIVE or set it to positive value, account is expired, but not a password.

Also, I configured PAM on machine.

Upd 2

I checked this on machine with RHEL 6.2 and without PAM configuration. Effect is the same.

4
  • You should try using chage -d 0 {user-name}. – Hastur Feb 22 '15 at 9:13
  • Is there way to do it automatically during useradd command, not with additional commands or actions? – Mike_Lychkov Feb 22 '15 at 9:47
  • 1
    EXPIRE=0 in /etc/default/useradd should do the job. I read you tried. Can you add the uncommented lines of /etc/default/useradd? It is locked even if you do not specify INACTIVE=-1, but a different value, or if you comment that line? Can you specify if accounts are locked even when created by command line. And, please, when you have a different question post it in a separate page if it will have diffent answer. – Hastur Feb 22 '15 at 11:25
  • 1
    Using adduser lets you put the chage command in /usr/local/sbin/adduser.local. You can also set the age field in /etc/shadow to 0 directly. useradd is the "low level utility," intended to be used in conjunction with other commands. – mpez0 Feb 22 '15 at 13:57
1

Since you're asking about RHEL6, I looked at the source code for useradd (which is delivered as part of the 'shadow' package). In useradd.c is a function called new_spent where it sets up a new shadow password entry. There it addresses the "expired password on creation" issue this way:

if (0 == spent->sp_lstchg) {
/* Better disable aging than requiring a password change */
spent->sp_lstchg = -1;

Soooo... If you set a zero it makes it a -1.

The authors of the program have coded specifically against setting the aging to 0 so it won't matter if you set it to 0 in the /etc/default/useradd parameter for EXPIRE. (If it was me doing that code I would have looked to see if the user was setting the password in the command and then allowing the expire, but it wasn't me...)

Also, it was suggested above that you could place a script into /usr/local/sbin/adduser.local to do a 'chage' command. This was good advice for a Debian/Ubuntu system where useradd is a perl script which does indeed run that file if it finds it, but on RHEL the useradd command is a C binary.

If I was you and I was determined to get that behavior on the RHEL6 useradd I'd get the SRPM for the shadow package, comment out those lines above and do an rpmbuild on the package and rockaway. Winning!

1

Why not add this to a script?

passwd -e username

If all you're after is the first login, this will work. The -e expires the account password immediately, so the next login the user is forced to update their password? (see man passwd)

1
  • And if you're looking for a chage specific solution, maybe try the "-M/--maxdays" switch with a value of '0'. I'm not really familiar with chage, but from the man page this looks reasonable. – tniles Dec 8 '15 at 20:27
-1

Automatic:

Update this file:

/etc/default/useradd

This file contains the details, what all settings will be applied to the new users created into the system with useradd command.

Just set the value of EXPIRE=0 in this file, and after that, every time when a new user will be created, they will be forced to change the password at the next login.

Source: GeekRide

Now, editing that file in the terminal was tough. So I changed the permissions of the file to 777 using:

chmod 777 /etc/default/useradd

and edited it in grub.

(Thanks to Linux Command.)

Checked in my Ubuntu 12.04.5 VM.

Manual:

Use the following syntax to force a user to change their password at next login on a Linux:

# chage -d 0 {user-name}

In this example, force tom to change his password at next logon, enter:

# chage -d 0 tom

-d 0 : Set the number of days since January 1st, 1970 when the password was last changed. The date may also be expressed in the format YYYY-MM-DD. By setting it to zero, you are going to force user to change password upon first login.

Source: nixCraft

Pure copy-paste. Literally. ;)
Checked on my Ubuntu 12.04.5 VM.

4
  • The OP want's this done automatically during useradd command, if you read the comments above. – Insane Oct 12 '15 at 21:30
  • Won't comment anything else, but chmod -R 777 / is a very stupid thing to do! – pulsejet Mar 7 '18 at 5:29
  • @PulseJet yes I know that in retrospect and this answer was a long time ago so please just let it be – Varad Mahashabde Mar 7 '18 at 5:31
  • @VaradMahashabde then I would suggest removing such stuff from your answers, since they should at least be sane for the next person who reads them. – pulsejet Mar 7 '18 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.