Issue the useradd command to create a locked
Unlock the account by issuing the passwd
command to assign a password and set password aging
Command line options for useradd are detailed in Table 33-1.
Comment for the user
Home directory to be used instead of default
Date for the account to be disabled in the
Number of days after the password expires until the
account is disabled. (If 0 is specified,
the account is disabled immediately after the password
expires. If -1 is specified, the
account is not be disabled after the password
Group name or group number for the user's default group
(The group must exist prior to being specified here.)
additional (other than default) group names or group numbers,
separated by commas, of which the user is a member. (The groups
must exist prior to being specified here.)
Create the home directory if it does not exist
Do not create the home directory
Do not create a user private group for the user
Create a system account with a UID less than 500 and
without a home directory
The password encrypted with crypt
User's login shell, which defaults to
User ID for the user, which must be unique and greater
For security reasons, it is good practice to require users to change
their passwords periodically. This can be done when adding or editing a
user on the Password Info tab of the
To configure password expiration for a user from a shell prompt, use
the chage command, followed by an option from Table 33-3, followed by the username of the user.
Shadow passwords must be enabled to use the chage
Specify the minimum number of days between which the user
must change passwords. If the value is 0, the password does
Specify the maximum number of days for which the password
is valid. When the number of days specified by this option
plus the number of days specified with the -d
option is less than the current day, the user must change
passwords before using the account.
Specify the number of days since January 1, 1970 the
password was changed.
Specify the number of inactive days after the password
expiration before locking the account. If the value is 0, the
account is not locked after the password expires.
Specify the date on which the account is locked, in the
format YYYY-MM-DD. Instead of the date, the number of days since
January 1, 1970 can also be used.
Specify the number of days before the password expiration
date to warn the user.
Table 33-3. chage Command Line Options
If the chage command is followed directly by a
username (with no options), it displays the current password aging
values and allows them to be changed.
If a system administrator wants a user to set a password the first
time the user log in, the user's initial or null password can be set
to expire immediately, forcing the user to change it immediately after
logging in for the first time.
To force a user to configure a password the first time the user logs
in at the console, follow these steps. Note, this process does not
work if the user logs in using the SSH protocol.
Lock the user's password — If the
user does not exist, use the useradd command to
create the user account, but do not give it a password so that it
If the password is already enabled, lock it with the command:
usermod -L username
Force immediate password expiration
— Type the following command:
chage -d 0 username
This command sets the value for the date the password was last
changed to the epoch (January 1, 1970). This value forces
immediate password expiration no matter what password aging
policy, if any, is in place.
Unlock the account — There are two
common approaches to this step. The administrator can assign an
initial password or assign a null password.
Do not use the passwd command to set the
password as it disables the immediate password expiration
To assign an initial password, use the following steps:
Start the command line Python interpreter with the
python command. It displays the
Python 2.2.2 (#1, Dec 10 2002, 09:57:09)
[GCC 3.2.1 20021207 (Red Hat Enterprise Linux 4 3.2.1-2)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
At the prompt, type the following (replacing
password with the password to encrypt
and salt with a combination of
exactly 2 upper or lower case alphabetic characters, digits, the
dot (.) character, or the slash (/) character such as
The output is the encrypted password, similar to
Type [Ctrl]-[D] to exit the
Cut and paste the exact encrypted password output, without
a leading or trailing blank space, into the
usermod -p "encrypted-password" username
Instead of assigning an initial password, a null password can
be assigned using the following command:
usermod -p "" username
While using a null password is convenient for both the user
and the administrator, there is a slight risk that a third party
can log in first and access the system. To minimize this threat,
it is recommended that the administrator verifies that the user
is ready to log in when the account is unlocked.
In either case, upon initial log in, the user is prompted for
a new password.