Visit the LQ Articles and Editorials section
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 06-25-2008, 03:16 PM   #1
Registered: Nov 2003
Posts: 737

Rep: Reputation: 39
Locking out a user when password expires, but allowing them to change their password

Hi there --

Is there a way to lock out users whose passwords have expired, but allow them the capability to connect and immediately change the expired password?
Old 06-25-2008, 06:10 PM   #2
LQ Guru
Registered: Feb 2003
Location: Blue Ridge Mountain
Distribution: Debian Wheezy, Debian Jessie
Posts: 7,670

Rep: Reputation: 229Reputation: 229Reputation: 229
No, because in order to connect you have to have a valid password.

Steve Stites
Old 06-25-2008, 06:49 PM   #3
Senior Member
Registered: Jul 2004
Distribution: Ubuntu 7.04
Posts: 1,990

Rep: Reputation: 68
jailbait's answer seems slightly simplified to me.

Linux normally uses PAM (pluggable authentication modules) to authenticate users, and you can do all sorts of weird and wonderful things, including getting terminal access and prompting for updated information if the password is out of date.

The problem is that you'd need to do quite a bit of programming to make that work, unless you can find a module that implements similar functionality already.

I think it may be easier to set up a web server that could allow the user to log in and change their system login password. I'm pretty sure you could set up an Apache webpage to authenticate a session user using the linux password through PAM, even bypassing the expiry date for the website but not for normal logins. But that's just one option of many.

A good starting point for further information might be the user authentication howto:
Old 06-27-2008, 01:11 PM   #4
Registered: May 2007
Posts: 33

Rep: Reputation: 15
We use pam on our redhat boxes but I don't know of any "temporarily let me in" module. If there is one, I would love to try that out.

I know that the /etc/shadow file allows you to set a "warning" time in # of days in the sixth field; we use 7 days. So as Joe-user logs in, he will get the reminder 7 days out that his password will expire and allow him to change it.
Format of the /etc/shadow is:

If Joe-user chooses to continue to ignore this message every time he logs in, then after 7 days, he gets to go visit the sysadmin to change his password.

Last edited by legcard; 06-27-2008 at 01:14 PM.
Old 06-27-2008, 02:02 PM   #5
Senior Member
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
Originally Posted by kaplan71
Is there a way to lock out users whose passwords have expired, but allow them the capability to connect and immediately change the expired password?
Assuming I understand your question, you could also use:

# chage -M 999 -d 1 user_here

P.S. Be sure to read the chage(1) manpages and actually understand what that does (and how it could potentially affect system password policies you have in place) before using it.


Edit: After re-reading your question and this thread, it seems likely that I've misunderstood.

Last edited by anomie; 06-27-2008 at 02:04 PM.
Old 06-27-2008, 08:12 PM   #6
Senior Member
Registered: Jul 2004
Distribution: Ubuntu 7.04
Posts: 1,990

Rep: Reputation: 68
To clarify: As I understand it, you want to give users the option to change their password without a full log-in session, if their password has expired.

Looking a bit further, GDM (the Gnome Display (Login) Manager) seems to have some sort of option to allow users to change their password after it has expired, and it does indeed use PAM.

See the second post on this page:

Other posts talk about PAM prompting to change the user's password if it has expired. So it's definitely possible.

Perhaps someone who understands PAM can explain how to chain things together to make this happen?


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
How could normal user obtain root password or change root password ckamheng Debian 18 02-18-2009 11:28 PM
samba(global security=user) useful tools for client.ex: user change password. hocheetiong Linux - Newbie 1 03-18-2008 10:20 AM
pam_cracklib not locking user after 3 bad password attempts legcard Linux - Security 3 06-25-2007 01:28 PM
Allowing user to change the password santhosh23 Linux - General 11 05-02-2007 01:36 AM
How can I change e-mail password(or linux account password) with php in website?? yusuf Programming 1 05-28-2004 10:39 AM

All times are GMT -5. The time now is 09:42 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration