Locking out a user when password expires, but allowing them to change their password
 

Hi there --

Is there a way to lock out users whose passwords have expired, but allow them the capability to connect and immediately change the expired password?

No, because in order to connect you have to have a valid password.

-------------------
Steve Stites

jailbait's answer seems slightly simplified to me.

Linux normally uses PAM (pluggable authentication modules) to authenticate users, and you can do all sorts of weird and wonderful things, including getting terminal access and prompting for updated information if the password is out of date.

The problem is that you'd need to do quite a bit of programming to make that work, unless you can find a module that implements similar functionality already.

I think it may be easier to set up a web server that could allow the user to log in and change their system login password. I'm pretty sure you could set up an Apache webpage to authenticate a session user using the linux password through PAM, even bypassing the expiry date for the website but not for normal logins. But that's just one option of many.

A good starting point for further information might be the user authentication howto: http://www.linuxdocs.org/HOWTOs/User...OWTO/x101.html

We use pam on our redhat boxes but I don't know of any "temporarily let me in" module. If there is one, I would love to try that out.

I know that the /etc/shadow file allows you to set a "warning" time in # of days in the sixth field; we use 7 days. So as Joe-user logs in, he will get the reminder 7 days out that his password will expire and allow him to change it.
Format of the /etc/shadow is:
username:passwd:last:min:max:warn:expire:disable:reserved

If Joe-user chooses to continue to ignore this message every time he logs in, then after 7 days, he gets to go visit the sysadmin to change his password.

Assuming I understand your question, you could also use:

# chage -M 999 -d 1 user_here

P.S. Be sure to read the chage(1) manpages and actually understand what that does (and how it could potentially affect system password policies you have in place) before using it.

-------------------------

Edit: After re-reading your question and this thread, it seems likely that I've misunderstood.

To clarify: As I understand it, you want to give users the option to change their password without a full log-in session, if their password has expired.

Looking a bit further, GDM (the Gnome Display (Login) Manager) seems to have some sort of option to allow users to change their password after it has expired, and it does indeed use PAM.

See the second post on this page: http://bugzilla.gnome.org/show_bug.cgi?id=356109

Other posts talk about PAM prompting to change the user's password if it has expired. So it's definitely possible.

Perhaps someone who understands PAM can explain how to chain things together to make this happen?