How to Change User Password in Linux | passwd Command

The passwd command is the standard Linux utility for managing user passwords and account access. You use it to change your own password (passwd) or, as an administrator, to reset another user’s password. It also controls login access by locking and unlocking accounts and can force a password reset on next login.

Let's consider the example

To change a user's password using the passwd command, follow these steps:

Step 1: Open a terminal on your Linux system.

Step 2: Type the following command and press Enter:

passwd 

• If you are not the root user, you will be prompted to enter your current password to proceed.
• You will then be prompted to enter the new password. Type the new password and press Enter.
• Retype the new password when prompted to confirm.
• The password for the specified user account is now changed.

Note: Linux does not display any characters on the screen while you type the password for security reasons.

Basic Syntax of `passwd` in Linux

 passwd [options] [username] 

Here,

• [options] = include various parameters to customize the password-changing process.
• [username] = the target user account for which you want to change the password.

'passwd' Command Table :

1. How to Change Another User's Password in Linux

As a system administrator (using sudo or as the root user), you can change the password for any user. This is most often used to reset a forgotten password.

Step 1: Open a terminal on your Linux system.

Step 2: Type the following command and press Enter:

sudo passwd user1 

• If you are not the root user, you may be prompted to enter your current password to proceed.
• You will then be prompted to enter the new password. Type the new password and press Enter. Linux does not display any characters on the screen while you type the password for security reasons.
• Retype the new password when prompted to confirm.
• The password for the user "john" is now changed.

Note: sudo can be used to invoke root privileges by normal users, and can change the password for root itself. This is particularly helpful when a user is member of admin group (holds a position in sudoers list (/etc/sudoers) and can use commands with sudo) and the root password is not set, which is case with many common distributions of linux.

sudo passwd root 

2. How to Change the User Password Forcely

To force a user to change their password at the next login, use the following command:

passwd -e user1

This immediately expires the user's password, requiring them to change it the next time they log in.

3. How to Lock and Unlock User Account in Linux

To lock or unlock a user account, use the following commands:

To lock the account:

sudo passwd -l user2

The password for the user "user2" is now locked, preventing login.

To unlock the account:

sudo passwd -u user2

The password for the user "user2" is now unlocked, allowing login again.

4. How to Set Password Expiry

The -x option allows you to set the maximum number of days a password is valid. Example:

sudo passwd -x 30 user3

This sets a maximum password age of 30 days for the user "user3"

How passwd Works

The passwd command is a safe tool for modifying the /etc/shadow file, which stores critical, encrypted password and aging information.

You should never edit this file directly. passwd is the correct interface.

A line in /etc/shadow looks like this: user1:$6$x8wA...an/:17887:0:99999:7:::

It's a list of 9 fields separated by colons:

1. User name: user1
2. Encrypted Password: $6$x8wA...an/ (If this starts with ! or *, the account is locked).
3. Last Change: The date the password was last changed.
4. Min Age: Minimum number of days before a password can be changed (default 0).
5. Max Age: Maximum number of days a password is valid (default 99999, meaning never expires).
6. Warn Days: Number of days before expiration to warn the user.
7. Inactive Days: Number of days after expiration before the account is fully disabled.
8. Expire Date: A specific date when the account is disabled.
9. Reserved: Unused.

When you run passwd -x 30 user1, you are simply changing Field 5 to 30. When you run passwd -l user1, you are just adding a ! to the start of Field 2.

user1:$6$x8wAJRpP$EWC97sXW5tqac10Q2TQyXkR.1l1jdK4VLK1pkZKmA2mbA6UnSGyo94Pis074viWBA3sVbkCptSZzuP2K.y.an/:17887:0:99999:7:::