In this video we'll talk about password properties.
Users can change their own password using passwd.
Administrators can manage passwords and their properties using passwd and change.
Change is for change aging information and you can use change l for a list of current settings.
The nice thing about changes is that the command prompts about changeable settings. So just
use sudo changes on the user and you'll be prompted for every setting that applies.
You can use different options with password s and change to change password properties. I would definitely
recommend you use change and not pass wd s because the interactive prompt is really convenient.
Also convenient is the option to change passwords without an interactive prompt.
On Red hat you can use echo password and send the output of
the echo command into a pipe using sudo passwd stdin on a username.
On Ubuntu it's slightly different, and there you use the chpasswd command.
So you would use echo username passwd pipe sudo chpasswd.
Now the fun thing is that chpasswd does exist on Red
Hat as well, but paswd standardin does not exist on Ubuntu.
Now password settings themselves are written to the etc shadow file. Let's have a look.
First thing that I would like to do is sudo change for lynda.
So here we see that change is prompting for the different settings for user lynda
minimum password age I want Linda to use her password at least for 3 days.
Maximum password days.
Let's make that a month. So she will be forced to change the password every month.
Last password change is the system setting. Don't change it.
Password expiration warning I want one day before the password expires. The user gets a message.
I'm not sending it to inactive, but I will expire the account on 2028 12.
And now my user has changed. So can we see that? Well, if I use sudo grab
Linda on etc shadow then you see the values behind the scene that have been modified.
What's all of this? Well, this here, this long string is the hash of the encrypted password.
This here is the number of days since January 1, 1970 that the user was
created. And here we have the minimum password, the maximum password date, the expiration, and
we have the account expiration date as a number of days since January 1, 1970.
I also like to demonstrate this option to change passwords without an interactive prompt.
So echo password pipe sudo
pass WD standardin Bob.
Oh boy, I see that I'm doing something wrong. The password
fills the dictionary check it's based on a dictionary word.
So did it change it? Well, when we use sudo grab bob on etc shadow
then we see that, well, despite the error message, it did change the password. So
that's good news. Anyway, the thing is, when you use a bad password you get
a warning, but as you are using your sudo superpowers, it's doing it anyway.
Now, what is the Ubuntu alternative?
Well, first let's check for a couple of users that don't have a password set yet. So I'm
using sudo till on etc shadow and I'm looking for users that in the second field have an
exclamation mark that means that password has not yet been set. So that is Lisa and Lori.
So I'm going to use echo lisa colon password pipe sudo chpasswd and
that's how you can also do it. An echo lorry colon password that
makes that all of my users at this point have a password.
As I mentioned, chpasswdo exists on red hat as well as Ubuntu paswd standard
in only exists on red hat, so probably you're better off using chpasswd.