passwd — Password management

💬 "passwd command"

passwd changes passwords or locks them. Service accounts are managed by blocking login itself.

Using expiration (-e) forces a password change at the next login.

• Concept: Sets, changes, or locks account passwords.
• Running as yourself: Changes your own password.
• Running as root: Changes another account's password.
• Status (-S): Shows whether a password is locked and expiration details.

Common options

3 essential command combinations

• passwd -S myapp — Check account lock status
• passwd -l myapp — Lock a service account
• passwd -e deploy — Force a password change at next login for the deployment account

💬 "Tell me how to validate this in advance on a dev server"

Here are common situations on live production servers, organized in order.

Step 1 · Check status

Check whether the account is locked and the last password change date.

passwd -S deploy

Step 2 · Change/lock

Change or lock the password as appropriate for its purpose.

passwd -l myapp

Step 3 · Verify

Check the status again.

passwd -S myapp

In practice, this is how it is used

1. Locking a service account

Situation — You need to remove login access for a service account.

passwd -l myapp && passwd -S myapp

Result — The status shows L(locked), so login is blocked.

Point — Combined with setting the shell to nologin, this blocks access twice.

2. Force an initial password change

Situation — You give a temporary password to a new employee and force them to change it.

passwd deploy && passwd -e deploy

Result — When they log in with the temporary password, a password change screen appears immediately.

Point — Deliver the temporary password through a secure channel and always require a change.

Things to watch out for

• Never put passwords directly on the command line (they are exposed in shell history).
• For service accounts, use only key authentication and disable password login.
• -d deletes the password and prevents login, but it can be risky depending on the configuration.

Actual execution screen

This is the result of checking the password status and locking a service account.

!passwd command execution result: password status and lock

Live production server

Source (HTML): https://games.aidebatehub.com/programs/linux/security/passwd.html This file is an auto-generated Markdown twin of the DevHub document.