user must change password at first logon

[Maaz]

help ?

[Ivan Ferreira]

chage -d 0

See also:

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1237877

[Maaz]

Hi Ivan thanks for help.

we have two issues/demands

1, user must change password at first logon
solution: chage -d 0

OK, done.

2, at 15th of every month each user password must expires, and every user must have to change his/her password

regards
maaz

[Jeeshan]

no. 2 issue check this link

http://www.cyberciti.biz/tips/linux-set-default-password-expiry-for-all-new-users.html

[Maaz]

Hi ahsan, thanks for help.

using /etc/login.defs alone, is not the solution .. because if a user has changed his/her password on 8th .. his/her password wont expires on 15th of that month.

what i need is that at 15th of each month every user must has to change his/her password.. or password must expires on 15th of every month for ever user.

I think it will be done by a script... am i right ? if yes then please share the code ;)

Regards

[Ivan Ferreira · Accepted solution]

With chage you can also specify a maximum password life, for example, 30 days. If you want to exactly do it every 15, for some extrange reson, then yes, you must script it.

Also, think about your users, changing passwords each month can be problematic, even for your administrators/help desk support.

Anyway, you can run in cron something like:

for USER in $( awk -F ":" '$3 > 500 { print $1 }' /etc/passwd)
do
chage -d 0 $USER
done

This will force all users with UID > 500 to change their passwors.

[Maaz]

Hi Ivan, thanks for help.
yes this is a strange issue, but this the customers requirement.

does this also works with ldap server ? i.e does "chage -d 0 " will also expires the password of ldap users/accounts ?

I am asking this question becuase the customer is asking about migration from NIS to LDAP domain...

Regards,
Maaz

[Ivan Ferreira]

does this also works with ldap server ?
According to "man chage", you can specify a binDN, that is, information to modify a LDAP directory server.

And tell your customer that should forget about NIS at this time.