Password policies and account locking · Linux

Production identity has three time dimensions: how often the password must change, when the account itself expires, and how the system responds to failed login attempts. The tools are chage, passwd, and PAM configuration.

chage — password aging

chage controls the password aging fields in /etc/shadow.

Read-only / Safechage -l— List all aging fields for a user. 'never' on every field is the default after user creation.

$ chage -l alice

Last password change					: Aug 09, 2026
Password expires					: never
Password inactive					: never
Account expires						: never
Minimum number of days between password change		: 0
Maximum number of days between password change		: 99999
Number of days of warning before password expires	: 7

Illustrative output

Configuration changeaging policy— -M 90 sets max age 90 days; -m 7 sets min 7 days; -W 14 warns 14 days before expiry. This is a typical production policy. Adjust to your compliance regime.

$ sudo chage -M 90 -m 7 -W 14 alice; chage -l alice

Last password change					: Aug 09, 2026
Password expires					: Nov 07, 2026
Password inactive					: never
Account expires						: never
Minimum number of days between password change		: 7
Maximum number of days between password change		: 90
Number of days of warning before password expires	: 14

Illustrative output

Locking and unlocking

Configuration changepasswd -l— passwd -l locks the account by prepending '!' to the password hash in /etc/shadow. The hash is preserved, so unlocking restores the previous password.

$ sudo passwd -l alice; getent shadow alice

alice:!$y$j9T$...$...:19550:7:90:14:::

Illustrative output

Configuration changepasswd -u— passwd -u unlocks the account by removing the '!' prefix. The original hash is restored. If you intend to force a password reset on next login, use chage -d 0 instead, or passwd -d (delete).

$ sudo passwd -u alice; getent shadow alice

alice:$y$j9T$...$...:19550:7:90:14:::

Illustrative output

Forcing a password reset

Configuration changeforce reset— chage -d 0 sets the last-change date to 1970-01-01, which the system treats as 'the password must be changed now'. On next login, alice is forced through passwd before reaching a shell.

$ sudo chage -d 0 alice; chage -l alice

Last password change					: password must be changed
Password expires					: never
...

Illustrative output

Account expiration

Configuration changeaccount expiration— chage -E DATE sets the account expiration. After the date, the account cannot log in via any method. Use ISO format YYYY-MM-DD or 'never' to clear. Useful for contractor accounts.

$ sudo chage -E 2026-12-31 alice; chage -l alice | grep 'Account expires'

Account expires						: Dec 31, 2026

Illustrative output

PAM modules enforce login attempt policies. The two relevant ones are pam_faillock (modern, recommended) and pam_tally2 (legacy).

Read-only / Safepam_faillock config— Three pam_faillock lines: preauth checks if the user is already locked; authfail records a failed attempt; authsucc clears the counter on success. pam_unix performs the actual password check.

$ cat /etc/pam.d/common-auth

auth	required			pam_faillock.so preauth
auth	[success=1 default=bad]	pam_unix.so
auth	[default=die]		pam_faillock.so authfail
auth	sufficient	pam_faillock.so authsucc

Illustrative output

Configuration changefaillock— faillock --user USER --reset clears the failed-attempt counter for a user. Useful after a genuine lockout — confirm the lockout was legitimate before unlocking.

$ sudo faillock --user alice --reset

Illustrative output

PAM configuration option	Effect
`deny=N`	Lock the account after N failed attempts
`unlock_time=N`	Auto-unlock after N seconds (or `never`)
`fail_interval=N`	The window in which failed attempts are counted
`audit`	Log every failed attempt to syslog
`silent`	Do not announce failure to the user

**Use pam_faillock, not pam_tally2.** pam_tally2 is deprecated
**Set deny=5 and unlock_time=900.** Five attempts in fifteen minutes is a reasonable baseline. Adjust for your threat model
Pair with a monitoring alert. Lockouts should appear in your SIEM. A lockout that nobody knows about is the same as no lockout
Test the unlock path. Confirm faillock user reset works from your break-glass account before an incident

chage — password aging

Locking and unlocking

Forcing a password reset

Account expiration

Failed-login lockout via PAM

Knowledge check