VMware ESXi and vSphere Cluster Management

Manage Linux Password Expiration with chage

Learn how to inspect and configure Linux password aging, expiration, warning, inactivity, and account expiration settings with chage.

Password aging controls how long a Linux password remains valid, when users are warned to change it, and what happens if they do not change it in time. The chage command lets administrators inspect and modify these settings for local user accounts.

This lesson assumes basic knowledge of Linux users, the command line, sudo, and local account management.

Why password aging matters

Password aging is the set of rules governing password-change timing, expiration, warnings, and post-expiration behavior. An organization may use these rules to reduce the risk of a password remaining usable after it has been exposed or reused for too long.

Password expiration means that a particular password has reached its maximum permitted age. The user may be required to change the password before normal account use can continue.

Account expiration is different: it is a fixed date after which the account itself cannot be used, regardless of whether its password is current. Account expiration is useful for temporary accounts, such as contractor or project accounts.

Advance warnings give users time to change their passwords before login disruption. Minimum-age rules can prevent repeated immediate changes, while an inactivity period can disable an account that remains unused after its password expires.

The chage command

chage is a command-line utility for viewing and changing password-aging information for local Linux accounts. Its general structure is:

chage [options] username

For example, this lists the aging information for the local account named bob:

chage -l bob

Listing information for your own account may be permitted without administrative access, depending on the operating system. Changing settings for another user normally requires root privileges or equivalent authorization:

sudo chage -M 30 bob

Use administrative privileges carefully. A change to a real user account can affect the next login, password changes, and account access.

View current password-aging settings

Use the -l option to display the current state:

sudo chage -l bob

A typical listing contains fields similar to these:

  • Last password change: The recorded date from which password-aging intervals are calculated.
  • Password expires: The date on which the current password reaches its maximum age and must be changed.
  • Password inactive: The date on which the account becomes disabled if the password expired and was not changed during the inactivity period.
  • Account expires: The fixed date after which the account itself cannot be used.
  • Minimum number of days between password change: The number of days a user must wait before changing the password again.
  • Maximum number of days between password change: The maximum lifetime of the password.
  • Number of days of warning before password expires: How far in advance the user is warned.
  • Number of days of inactivity after password expires: The post-expiration grace period before disabling the account.

A value such as never generally means that the corresponding limit is disabled or unset. Always verify the exact result on the target system because display wording and default values can vary between Linux distributions.

Important chage options

Option — Purpose — Value format — Effect on the account

-l — List settings — username — Displays password and account aging information.

-m — Set minimum password age — days — Prevents another password change until the specified number of days has passed.

-M — Set maximum password age — days — Causes the password to expire after the specified number of days from the last password change.

-W — Set warning period — days — Warns the user this many days before password expiration.

-I — Set inactive period — days — Disables the account this many days after password expiration if the password remains unchanged.

-E — Set account expiration date — YYYY-MM-DD — Prevents account use after the specified calendar date.

-d — Set last password-change date — date — Changes the recorded starting point used for password aging.

Set the maximum password age

The maximum password age is the number of days a password remains valid. The interval is calculated from the recorded last password-change date.

To require bob to change the password every 30 days:

sudo chage -M 30 bob

After this change, the password expiration date is calculated using the last password-change date plus 30 days.

On systems that support it, a negative value such as -1 disables the maximum password age:

sudo chage -M -1 bob

Disabling the maximum age can result in a password that does not expire through normal aging rules. Use that setting only when it matches documented security policy.

Set the minimum password age

The minimum password age prevents a user from changing a password again immediately after changing it. To require at least one day between password changes:

sudo chage -m 1 bob

The minimum age must be considered together with the maximum age. For example, a minimum of 30 days and a maximum of 10 days is impractical because the user could be required to change a password before being allowed to change it again. Choose values that allow the required password lifecycle to work normally.

Configure password-expiration warnings

The warning period determines how many days before expiration the user receives a warning. To warn bob one week before expiration:

sudo chage -W 7 bob

A warning period does not extend the password's lifetime. It gives the user an opportunity to change the password before the expiration deadline causes login disruption.

Handle inactive passwords

The inactive period begins after the password has expired. It is not the same as the normal password-expiration interval.

To allow 14 days after password expiration before disabling the account:

sudo chage -I 14 bob

The sequence is:

  1. The password remains valid until the maximum age is reached.
  2. The user receives warnings during the configured warning period.
  3. The password expires.
  4. The account may remain usable during the configured inactive period, subject to the system's login behavior.
  5. If the password is still not changed, the account becomes disabled because of inactivity.

Set an account expiration date

Use -E to set a fixed end date for the account itself. The usual date format is YYYY-MM-DD:

sudo chage -E 2026-12-31 bob

This is appropriate for a temporary account. It is independent of password rotation: a password can be current while the account has expired, or a password can expire before the account's fixed end date.

On systems that support it, -1 removes the configured account expiration date:

sudo chage -E -1 bob

Verify the result with chage -l. If a date is rejected or behaves unexpectedly, check the required date format and inspect the resulting account state.

Set the last password-change date

The -d option changes the recorded date of the last password change. This date is the starting point for calculating the minimum age, maximum age, warning period, and related deadlines.

For example:

sudo chage -d 2026-08-01 bob

An administrator can also use an appropriate last-change value to force a password update at the next login. A commonly supported technique is:

sudo chage -d 0 bob

This changes password-aging state; it does not set a new password. The user must complete the password change through the login system. Test this behavior according to the distribution and authentication stack in use.

Password expiration versus account expiration

Setting — What expires — When it takes effect — Typical use case

Maximum password age — The user's current password — After the configured number of days from the last password change — Routine password rotation.

Inactive period — Continued access after an expired password — After password expiration plus the configured inactivity period — Disabling accounts whose expired passwords were not updated.

Account expiration date — The account itself — At a fixed calendar date — Temporary, contractor, training, or project accounts.

Apply and verify a complete policy

Before changing accounts broadly, document the organization's policy values. Record the intended minimum age, maximum age, warning period, inactivity period, exceptions, and account end dates.

First inspect the existing state:

sudo chage -l bob

Then apply a sample policy requiring at least one day between password changes, a maximum password age of 30 days, warnings during the final seven days, and account disablement 14 days after password expiration:

sudo chage -m 1 -M 30 -W 7 -I 14 bob

Verify the resulting state immediately:

sudo chage -l bob

Compare the displayed last-change date, expiration date, warning period, inactivity period, and account expiration date with the documented policy. Test on a noncritical sample account before applying a policy to many users.

Where the account data is stored

Linux keeps local account identity information separate from protected password data. /etc/passwd contains user identity and login-related fields, but normally does not contain password hashes.

/etc/shadow is the protected local database that commonly contains password hashes and password-aging fields. Its permissions are restricted because exposing this data can weaken account security.

Use chage, passwd, and other supported account-management utilities instead of directly editing /etc/passwd or /etc/shadow. Manual edits can corrupt field formats, create inconsistent dates, or produce an account that behaves differently from the intended policy.

Troubleshooting

Insufficient permission

If the command reports insufficient permission, the current user is probably trying to modify another account without administrative privileges. Run the command with sudo or use an authorized administrative account:

sudo chage -M 30 username

The user must change a password or cannot log in

Inspect the account:

sudo chage -l username

Check whether the maximum age has been reached, the password has become inactive after expiration, or the account expiration date has passed. Adjust only the relevant setting and follow organizational policy.

The expiration date is rejected

Use the expected YYYY-MM-DD format, for example:

sudo chage -E 2026-12-31 username

Then verify the result with sudo chage -l username. Date support and accepted input details can vary between implementations.

The user cannot immediately change a password

A nonzero minimum password age may still be active. Review the setting with chage -l. Change it only if the policy permits, because removing a minimum age can allow rapid repeated changes.

Password aging appears disabled

If the maximum age is unset or displayed as a non-expiring value, set an explicit maximum age:

sudo chage -M 30 username

Confirm that a password expiration date is now calculated.

Editing /etc/passwd did not change expiration behavior

Password-aging information is generally maintained in protected shadow-account data rather than the public account file. Use chage or another supported account-management utility instead of manually editing account databases.

Exam-relevant notes

  • -M sets the maximum password age; it does not directly set a calendar expiration date.
  • -m sets the minimum number of days between password changes.
  • -W sets the warning period before password expiration.
  • -I sets the post-expiration inactivity period before disabling the account.
  • -E sets a fixed account expiration date, which is different from password expiration.
  • -d changes the recorded last password-change date and can be used administratively to require a password update at next login; it does not set the password itself.
  • chage -l username is the primary verification command.
  • /etc/passwd stores identity information, while protected /etc/shadow data commonly stores password hashes and aging fields.

For related local-account administration, continue with Linux password management.