For local Linux accounts managed through shadow-utils, an administrator can configure password expiry with chage, then verify the account’s aging record and test the actual login path. If your organization requires periodic changes, set the interval it specifies; the 90-day example below is illustrative, not a universal security recommendation. For policy decisions, note that NIST says verifiers and credential service providers (CSPs) in its digital-identity context should not require periodic password changes, but should force a change when there is evidence of compromise.
Set an expiration policy for a local account
On a system where the account is managed in the local shadow password database, use chage to set a maximum password age and advance warning period. For example:
sudo chage -M 90 -W 14 usernameIn this example, -M 90 sets the maximum password age to 90 days, and -W 14 tells the system to warn the user 14 days before expiry. These are sample values, not a recommended schedule. Choose values only after checking the policy and the system’s role.
The chage manual documents additional aging controls:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
-m DAYSsets the minimum number of days between password changes.-I DAYSsets how long a password may remain expired before the account is locked. This is an access-control consequence, not just a reminder setting: a user locked after the grace period may need an administrator to restore access.
Verify the setting or require a change at next login
List the aging information recorded for a local account:
sudo chage -l usernameThis displays information from the shadow password file. It does not report password-aging policy held in LDAP or another external identity source.
To require a password change the next time the account logs in, set its last password-change date to zero:
sudo chage -d 0 usernameThe chage manual defines this zero date as requiring a change at the next login. passwd -e username is another documented way to expire a password immediately. Password changes made through passwd use PAM; its -x, -w, and -i options set maximum age, warning days, and inactivity, respectively. See the passwd manual.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Set defaults for new accounts and update existing accounts separately
PASS_MAX_DAYS, PASS_MIN_DAYS, and PASS_WARN_AGE in /etc/login.defs provide aging defaults used when accounts are created. Changing those values does not change existing user records. The login.defs manual documents this scope, and the useradd manual explains that useradd uses the defaults when creating accounts.
For existing users, update the intended accounts individually or through a reviewed administrative process. Define the target set first: policy may exclude system and service accounts, non-password identities, and accounts managed elsewhere. Do not apply an unreviewed loop to every entry in /etc/passwd; there is no universal safe account-selection command.
Rank #4
Confirm that the real login path enforces the policy
A recorded shadow-file expiry is not proof that every way of logging in will require a password change. First determine whether the account is local, directory-backed, or managed by another identity service. Then inspect the PAM configuration for the service users actually access—such as the relevant console or remote-login service—and validate the change-required experience through that same path.
The pam_unix documentation describes the no_pass_expiry option, which can cause shadow expiry to be ignored in some cases when another authentication method has succeeded. A local chage -l result cannot establish what an external directory enforces, so check the authoritative identity source and the applicable PAM service configuration.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Best Value
Decide whether periodic changes are actually required
NIST SP 800-63B-4 states: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised.” This guidance applies to the verifier/CSP digital-identity context covered by that standard; administrators must still follow applicable organizational policy and the requirements for their systems.
NIST’s SP 800-63 FAQ explains qualitatively that scheduled changes can encourage weaker passwords or predictable transformations. Expiry by itself does not prove that a password was exposed, that the user chose a stronger replacement, or that an attacker has been removed. If a binding policy requires routine expiry, configure it deliberately; when compromise is evidenced, require a change and address the incident through the organization’s response process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
