18.2 Change Passwords and Adjust Password Aging

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

18.2 Change Passwords and Adjust Password Aging

Key Takeaways Explain This Topic AI

Set and change passwords with passwd; on RHEL, passwd --stdin is the common non-interactive method as root for exam scripting speed.

Use chage to view (-l) and set password aging: -m min, -M max, -W warn, -I inactive, -E account expire, -d last change (0 forces change at next login).

Account expiration (-E) is not the same as password maximum age (-M); read the task language carefully and verify with chage -l.

Defaults for new accounts often come from PASS_* settings in /etc/login.defs, but named-user tasks are satisfied with chage on that user.

passwd -e or chage -d 0 expires the password so the user must set a new one at next login—confirm after setting an initial password.

Last updated: August 2026

18.2 Change Passwords and Adjust Password Aging

Quick Answer: Set or change passwords with passwd . Inspect and set aging with chage ( -l list, -M max days, -m min days, -W warn, -E expire date, -I inactive, -d last change). Defaults for new accounts often come from /etc/login.defs . Force an immediate password change with chage -d 0 user or passwd -e user . Verify with sudo chage -l user and the shadow fields.

Why password aging is an EX200 skill

Local accounts are incomplete until authentication policy matches the task. EX200 language looks like:

“Set the password for user alice .”
“Password must expire every 90 days.”
“User must change password at next login.”
“Account expires on 2026-12-31.”
“Minimum password lifetime 2 days; warn 7 days before expiry.”

You need both password setting ( passwd ) and aging controls ( chage / related passwd flags). Configuration is stored primarily in /etc/shadow and must persist after reboot (it does—these are file-backed).

passwd: set and manage passwords
Interactive and stdin sudo passwd alice # prompts twice for new password
echo 'S3curePass!' | sudo passwd --stdin alice # non-interactive (RHEL)

As root, you can set another user’s password without knowing the old one. As an unprivileged user, passwd changes your own password and may enforce quality checks ( pam_pwquality and related PAM modules). passwd # change own password

Useful passwd status flags

Command Effect
passwd -l user Lock account password
passwd -u user Unlock
passwd -d user Delete password (empty)—often undesirable
passwd -e user Expire password (force change on next login)
passwd -n MIN user Minimum days between changes
passwd -x MAX user Maximum password lifetime (days)
passwd -w WARN user Warn days before expiry
passwd -i INACT user Inactive days after password expiry
passwd -S user Short status line sudo passwd -S alice
sudo passwd -l alice
sudo passwd -u alice
sudo passwd -e alice

RHCSA preference: Many training paths teach chage for aging clarity and passwd for setting the secret. Either aging interface can satisfy tasks if the shadow end state is correct—know chage -l as your primary verification tool.

/etc/shadow fields (mental model) name:hash:lastchange:min:max:warn:inactive:expire:reserved

Field Meaning
hash Password hash, or ! / !! / * for locked/no password
lastchange Days since 1970-01-01 of last password change
min Minimum days before password may be changed again
max Maximum days password remains valid
warn Days before max when user is warned
inactive Days after password expires before account is disabled
expire Account expiration day (absolute), not the same as password max sudo grep '^alice:' /etc/shadow
sudo chage -l alice

Prefer chage -l for human-readable output over decoding epoch day numbers by hand under time pressure.

chage: the aging Swiss army knife
List policy sudo chage -l alice

Example fields you will see:

Last password change
Password expires
Password inactive
Account expires
Minimum/Maximum/Warning numbers
Set policy (common exam options)

Option Purpose
m MIN Minimum days between password changes
M MAX Maximum password age in days
W WARN Warning days before password expires
I INACT Inactivity days after password expire → disable
E DATE Account expiration ( YYYY-MM-DD or days; -E -1 clears)
d LAST Set last password change day ( 0 = force change next login)
l List # Classic corporate-style policy
sudo chage -m 2 -M 90 -W 7 -I 14 alice
sudo chage -l alice # Account (login) expires on a calendar date
sudo chage -E 2026-12-31 alice
sudo chage -E -1 alice # remove account expiration # Force password change at next login
sudo chage -d 0 alice

# equivalent idea:

sudo passwd -e alice
sudo chage -l alice
Combining create + password + aging sudo useradd -m -s /bin/bash alice
echo 'InitialP@ss1' | sudo passwd --stdin alice
sudo chage -d 0 -M 60 -m 1 -W 7 alice
sudo chage -l alice

Set a known password before or as part of the task so the user can log in once and be forced to change it when -d 0 / passwd -e is required.

login.defs defaults (new accounts) grep -E '^PASS_' /etc/login.defs

Typical keys:

Key Role
PASS_MAX_DAYS Default max age applied for new entries
PASS_MIN_DAYS Default min days
PASS_MIN_LEN Historical length hint (PAM may enforce differently)
PASS_WARN_AGE Default warning days

Changing login.defs affects future default application for new users more than rewriting every existing account. If the task names one user , use chage on that user rather than rewriting global defaults unless asked. # Inspect defaults; avoid casual global edits on the exam

grep -E '^PASS_MAX_DAYS|^PASS_MIN_DAYS|^PASS_WARN_AGE' /etc/login.defs
Account expire vs password expire

These are easy to confuse:

Mechanism What it limits Typical control
Password max age ( -M ) How long the password remains valid chage -M , passwd -x
Force change ( -d 0 / passwd -e ) Password considered immediately expired next login must set new password
Account expire ( -E ) When the account may no longer log in calendar end date for the person/contractor
Lock ( passwd -l / usermod -L ) Authentication rejected via locked hash temporary disable

A user can have a valid password age but a past account expiration—or the reverse. Read the task words: “password expires every N days” → -M ; “account expires on DATE” → -E ; “must change password at next login” → -d 0 or passwd -e .

Inactive days ( -I )

After the password expires, inactive days may pass before the account is fully disabled for login: sudo chage -M 90 -I 7 alice

Meaning pattern: password valid 90 days; after it expires, 7 more days of grace (policy-dependent messaging) before inactive disable—confirm with chage -l wording. Use exactly the numbers the task specifies.

Password quality (awareness)

On RHEL, PAM modules (for example pam_pwquality via /etc/security/pwquality.conf ) may reject weak passwords for non-root paths. As root setting another user’s password, quality rules are often less strict—but extremely weak passwords can still fail depending on configuration. If passwd rejects a password:

Choose a longer mixed password.

Retry.

Do not disable PAM system-wide on the exam unless a task explicitly redesigns authentication (unlikely for core RHCSA user tasks).

Locking and unlocking (overlap with 18.1) sudo passwd -l alice
sudo passwd -S alice
sudo passwd -u alice
sudo usermod -L alice
sudo usermod -U alice

Locked accounts show ! or !! prefixes in the shadow hash field. Unlocking restores use of the existing hash when appropriate. Deleting a password with passwd -d can leave an account oddly accessible depending on PAM— prefer lock/expire patterns taught in training over empty passwords.

Verification habits sudo chage -l alice
sudo passwd -S alice
sudo grep '^alice:' /etc/shadow
# optional: date math sanity—max days and warn match the task

If the task requires next-login change, confirm Last password change is set such that the password is expired (commonly via day 0 semantics shown in chage -l as requiring change).

Exam workflows
Workflow A — Set password only echo 'CorrectHorseBattery1' | sudo passwd --stdin alice
sudo passwd -S alice
Workflow B — 90-day max, 7-day warn, 2-day min sudo chage -m 2 -M 90 -W 7 alice
sudo chage -l alice
Workflow C — Must change password at next login echo 'TempPassw0rd!' | sudo passwd --stdin alice
sudo chage -d 0 alice
# or: sudo passwd -e alice
sudo chage -l alice
Workflow D — Contractor account ends on a date sudo chage -E 2026-12-31 alice
sudo chage -l alice | grep -i 'Account expires'
Workflow E — Full package for one user sudo useradd -m -s /bin/bash contractor1
echo 'InitP@ss9' | sudo passwd --stdin contractor1
sudo chage -d 0 -m 1 -M 30 -W 5 -I 3 -E 2026-11-30 contractor1
sudo chage -l contractor1
Common traps

Setting PASS_MAX_DAYS in login.defs only and forgetting chage on the named user when the task targets that user.

Mixing up -E account expire with -M password max days .

Using chage -d 0 without first setting a password—user may be stuck depending on process.

Assuming passwd interactive prompts work the same in all non-interactive exam automation—know --stdin on RHEL.

Forgetting sudo so chage -l / shadow reads fail.

Setting min days higher than max days—nonsensical policy; follow task numbers carefully.

Locking with passwd -l when the task asked only for aging—do not overshoot.

Not re-running chage -l after changes.

Confusing inactive ( -I ) with account expire ( -E ) .

Expecting aging to “enable a service”—no systemd step; files alone persist.

Relationship to other sections

18.1 Users: accounts must exist before passwords/aging; locks overlap.

18.3 Groups: membership does not set passwords.

18.4 sudo: password prompts for sudo still use the user’s password policy.

SSH key auth (security chapter): key login can bypass password entry, but account lock/expire still matter.

PAM/security: quality and lockouts are related but deeper PAM redesign is beyond basic aging tasks.

Section checkpoint

You should set passwords with passwd (including RHEL --stdin ), lock/unlock and expire passwords when required, configure min/max/warn/inactive/account expire with chage , force next-login changes with chage -d 0 or passwd -e , understand /etc/shadow and login.defs defaults, and verify everything with chage -l . That meets the EX200 objective to change passwords and adjust password aging on RHEL 10.