Locking out a user when password expires, but allowing them to change their password
Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
jailbait's answer seems slightly simplified to me.
Linux normally uses PAM (pluggable authentication modules) to authenticate users, and you can do all sorts of weird and wonderful things, including getting terminal access and prompting for updated information if the password is out of date.
The problem is that you'd need to do quite a bit of programming to make that work, unless you can find a module that implements similar functionality already.
I think it may be easier to set up a web server that could allow the user to log in and change their system login password. I'm pretty sure you could set up an Apache webpage to authenticate a session user using the linux password through PAM, even bypassing the expiry date for the website but not for normal logins. But that's just one option of many.
We use pam on our redhat boxes but I don't know of any "temporarily let me in" module. If there is one, I would love to try that out.
I know that the /etc/shadow file allows you to set a "warning" time in # of days in the sixth field; we use 7 days. So as Joe-user logs in, he will get the reminder 7 days out that his password will expire and allow him to change it.
Format of the /etc/shadow is:
usernameasswd:last:min:max:warn:expire:disable:reserved
If Joe-user chooses to continue to ignore this message every time he logs in, then after 7 days, he gets to go visit the sysadmin to change his password.
Is there a way to lock out users whose passwords have expired, but allow them the capability to connect and immediately change the expired password?
Assuming I understand your question, you could also use:
# chage -M 999 -d 1 user_here
P.S. Be sure to read the chage(1) manpages and actually understand what that does (and how it could potentially affect system password policies you have in place) before using it.
-------------------------
Edit: After re-reading your question and this thread, it seems likely that I've misunderstood.
To clarify: As I understand it, you want to give users the option to change their password without a full log-in session, if their password has expired.
Looking a bit further, GDM (the Gnome Display (Login) Manager) seems to have some sort of option to allow users to change their password after it has expired, and it does indeed use PAM.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.