How to Change Password Linux: A Step-by-Step Guide for Secure Systems

For anyone digging into the world of Linux, knowing how to change a password is a must-have skill. Whether you’re tweaking your own password, creating a secure login for a new user, or managing password expirations, mastery over this task ensures smooth system operations. To change a password in Linux, use the passwd command followed by a specified username or, if no username is given, it defaults to the current user. This tiny command is a powerhouse, providing the security backbone for managing user credentials.

Think of the passwd command like your trusty Swiss Army knife. With a few simple switches, you can lock, unlock, and even set expiration dates for passwords. We’ve all been there—trying to remember which password you set in a moment of panic. Not to worry. This guide provides clear instructions, mixing a bit of empathy because, let’s be honest, forgetting passwords can be a headache.

By the end of this post, not only will you feel confident in changing passwords, but you’ll also pick up a few tricks for boosting security across your Linux systems. After all, robust password management isn’t just about protection; it’s about keeping your digital life organized and stress-free. Stay tuned for a deep dive into one of the most essential commands in your Linux toolkit.

Fundamentals of Linux Password Management

Linux password management primarily revolves around two core elements: the passwd command and the /etc/shadow file. These tools play an essential role in maintaining user authentication and security within the system.

Understanding the passwd Command

The passwd command is indispensable for managing user passwords on a Linux system. As administrators, we use it to set or change passwords for users. Executing this command without arguments changes the password for the current user:

passwd

Running it as a superuser allows changing another user’s password:

sudo passwd username

The system prompts for the current password before setting a new one if you’re not root.

Using passwd ensures that passwords are updated correctly and securely across the system’s authentication files. Ever wonder why it prompts twice for the new password? It’s to prevent typos and ensure accuracy!

The Role of the /etc/shadow File

The /etc/shadow file is where the magic happens for password storage. It contains user account information, including encrypted passwords.

• Location: /etc/shadow
• Security: Only accessible to root and privileged users

Here’s a peek at its format:

username:encrypted_password:last_change:min:max:warn:inactive:expire

Each field is separated by a : and includes details like the last password change date and password expiry information.

Unlike /etc/passwd, which contains non-sensitive user information, /etc/shadow focuses strictly on secure storage of authentication credentials. This separation ensures that sensitive data remains inaccessible to unauthorized users. This robust mechanism allows our Linux systems to maintain high security standards.

Executing Password Changes and Resets

When managing user accounts in Linux, it’s essential to know how to change passwords effectively, including changing another user’s password and forcing a password reset.

How To Change Another User’s Password in Linux

To change another user’s password, we must have root or sudo privileges. Here’s how we can do it using the passwd command:

1. Log in as root or a user with sudo privileges.
2. Open a terminal.
3. Use the command: sudo passwd [username].

For example, if we want to change the password for a user named “alex,” we would type:

sudo passwd alex

The system then prompts us to enter a new password and confirms it by asking us to retype it. The password is changed immediately, aiding in maintaining system security.

Force a Password Reset with –Expire Option

Sometimes we need to force a user to change their password on the next login. This is particularly useful for new accounts or accounts that may have been compromised. To achieve this, we can use the --expire option with the passwd command:

1. Log in as root or use sudo.
2. Open a terminal.
3. Execute: sudo passwd --expire [username].

For instance, to force a password reset for user “maria,” the command would be:

sudo passwd --expire maria

When Maria logs in next, the system will prompt her to change her password immediately. This ensures that only she knows her new password and helps secure user access.

Enhancing Security with Password Policies

Let’s look at key methods and best practices to strengthen Linux password security, which include setting expiration and aging parameters, and ensuring strong password creation.

Setting Password Expiry and Aging Parameters

We need to ensure that users regularly update their passwords. This reduces the risk of compromised passwords being used indefinitely.

To set password aging rules:

sudo nano /etc/login.defs

Modify the following parameters:

• PASS_MAX_DAYS: Maximum number of days a password can be used.
• PASS_MIN_DAYS: Minimum number of days before a user can change their password again.
• PASS_WARN_AGE: Number of days before expiration that the user will receive a warning.

Consider setting PASS_MAX_DAYS to 90, forcing quarterly password changes. Set PASS_WARN_AGE to 7 to give users a week’s notice. Shorter intervals, like 30 days, enhance security but may inconvenience users.

Best Practices for Strong Password Creation

Creating strong passwords is another critical step to enhance security. Here, we focus on length, complexity, and uniqueness. Use pam_pwquality to enforce these rules.

Add the following to your PAM configuration:

password requisite pam_pwquality.so retry=3 minlen=12 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1

This setup enforces:

• Minimum length of 12 characters.
• At least one upper-case letter.
• At least one lower-case letter.
• At least one special character.

Encourage users to create unique passwords that do not include easily guessable information such as birthdays or simple sequences like “1234”. Remind them to avoid reusing passwords across different platforms.

Consistently enforcing these practices can significantly enhance the overall security of our Linux systems.

Advanced Operations for System Administrators

For system administrators, managing user accounts and ensuring security are crucial tasks. We delve into key operations that help maintain system stability and security.

Managing User Accounts and Groups

Managing user accounts in Linux involves a mix of commands and best practices. Using sudo and su gives administrators elevated privileges.

To manage a user:

• Add a new user:

  sudo adduser newusername
  

• Modify a user:

  sudo usermod -aG groupname username
  

• Delete a user:

  sudo deluser username
  

Grouping users is equally important. For group management:

• Create a new group:

  sudo addgroup newgroup
  

• Add a user to a group:

  sudo adduser username groupname
  

Keeping user accounts streamlined ensures better management and security. We should regularly review and update group memberships to reflect current roles.

Preventing Security Breaches with Root Privileges

Security breaches can be prevented with careful root privilege management. Root access should be strictly controlled.

• Changing the root password:

  sudo passwd
  

Using sudo judiciously ensures tasks are performed with necessary permissions without full root access.

Forcing password changes:

• Expire passwords:

  sudo passwd -e username
  

• View password expiration:

  sudo chage -l username
  

Monitoring and auditing sudo usage plays a huge role in spotting security vulnerabilities early. We must set strict policies for sudo access, ensuring only trusted users have the needed permissions to keep the system secure.