|
|
Shell Script for "Password Management"
|
|
passwd(1) General Commands Manual passwd(1) NAME
passwd - change user password SYNOPSIS
passwd [-f|-g|-s|-k[-q]] [name] passwd [-D binddn][-n min][-x max][-w warn][-i inact] account passwd [-D binddn] {-l|-u|-d|-S[-a]|-e} name passwd --bioapi [account] passwd --stdin [account] DESCRIPTION
passwd changes passwords for user and group accounts. While an administrator may change the password for any account or group, a normal user is only allowed to change the password for their own account. passwd also changes account information, such as the full name of the user, their login shell, password expiry dates and intervals or disable an account. passwd is written to work through the PAM API. Essentially, it initializes itself as a "passwd" service and utilizes configured "password" modules to authenticate and then update a user's password. A sample /etc/pam.d/passwd file might look like this: #%PAM-1.0 auth required pam_unix2.so nullok account required pam_unix2.so password required pam_pwcheck.so nullok password required pam_unix2.so nullok use_first_pass use_authtok session required pam_unix2.so Password Changes If an old password is present, the user is first promted for it and the password is compared agaisnt the stored one. This can be changed, depending which PAM modules are used. An administrator is permitted to bypass this step so that forgotten passwords may be changed. After the user is authenticated, password aging information are checked to see if the user is permitted to change their password at this time. Else passwd refuses to change the password. The user is then prompted for a replacement password. Care must be taken to not include special control characters or characters, which are not available on all keyboards. If the password is accepted, passwd will prompt again and compare the second entry against the first. Both entries are require to match in order for the password to be changed. OPTIONS
-f Change the finger (gecos) information. This are the users fullname, office room number, office phone number and home phone number. This information is stored in the /etc/passwd file and typically printed by finger(1) and similiar programs. -g With this option, the password for the named group will be changed. -s This option is used to change the user login shell. A normal user may only change the login shell for their own account, the super user may change the login shell for any account. -k Keep non-expired authentication tokens. The password will only be changed if it is expired. -q Try to be quiet. This option can only be used with -k. Password expiry information -n min With this option the minimum number of days between password changes is changed. A value of zero for this field indicates that the user may change her password at any time. Else the user will not be permitted to change the password until min days have elapsed. -x max With this option the maximum number of days during which a password is valid is changed. When maxdays plus lastday is less than the current day, the user will be required to change his password before being able to use the account. -w warn With this option the number of days of warning before a password change is required can be changed. This option is the number of days prior to the password expiring that a user will be warned the password is about to expire. -i inact This option is used to set the number of days of inactivity after a password has expired before the account is locked. A user whose account is locked must contact the system administrator before being able to use the account again. A value of -1 disables this feature. Account maintenance -l A system administrator can lock the account of the specified user. -u A system administrator can unlock the specified account, if the account is not passwordless afterwards (it will not unlock an account that has only "!" as a password). -d The password of the given account can be deleted by the system administrator. If the BioAPI interface is used the BioAPI data for that account is removed. -S Report password status on the named account. The first part indicates if the user account is locked (LK), has no password (NP), or has an existing or locked password (PS). The second part gives the date of the last password change. The next parts are the minimum age, maximum age, warning period, and inactivity period for the password. -a Report the password status for all accounts. Can only be used in conjunction with -S. -e The user will be forced to change the password at next login. -P path Search passwd and shadow file in path. This option cannot be used with changing passwords. --bioapi This option is used to indicate that passwd should use the BioAPI for managing the authentication token of an account. It is only supported with a small subset of other options. This option is not always available. --stdin This option is used to indicate that passwd should read the new password from standard input, which can be a pipe (only by a system administrator). Name service switch options -D binddn Use the Distinguished Name binddn to bind to the LDAP directory. FILES
passwd - user account information shadow - shadow user account information SEE ALSO
passwd(1), group(5), passwd(5), shadow(5), pam(5) AUTHOR
Thorsten Kukuk <kukuk@suse.de> pwdutils November 2005 passwd(1)
