- All right, for people users,
passwords are pretty important as well.
So what can we manage with these passwords?
Well, first, you should note
that users can change their password using passwd.
If you have administrative privileges,
you can manage passwords in their properties
as well, using passwd and CH-AGE or chage, if you want to.
How does that work?
We'll use chage -l for a list of current settings
so that you can see what currently applies.
You can use chage on a user account
for prompts about all the changeable settings,
and that's pretty convenient if you use chage * Linda,
then chage is going to ask setting by setting
if you want to accept or change.
There's also an option to use passwd -S
to show the current options that are available.
If you want to change passwords,
you can also do that without using an interactive prompt.
A very convenient option is to change passwords
without an interactive prompt.
On Red Hat, you would use echo password
and pipe that to passwd with the option dash dash
standard in. Notice that you need pseudo
in order to run that command, obviously.
On Ubuntu you would use echo username, colon password
and send that to chpasswd
which is also used with pseudo privileges, obviously
and the passwords themselves
they are written to etc shadow.
Let me show you how to work with these options.
So to start with, I'm using pseudo passwd minus S
on a user account.
And here we can see all the different options
that currently apply.
If I want to change these options, I would definitely
use sudo followed by change and the name
of the user account, because you are prompted option
by option, and that makes it easy to understand.
So minimum password age, let's do one day.
Maximum password age, Let's make that 900
last password change
that is always set to here.
And now I'm not going to edit that on this new user account.
Expiration warning, I'm okay.
Password inactive, not needed. Account expiration date?
I want this account to expire on 2022/12/21.
And there we go.
We have just set the, the user properties.
Now, what does this look like?
Well, we can investigate.
sudo grep Linda on etc shadow.
etc shadow is a very secret file where password
properties are stored.
So the first field is the username.
After the username
we have the hash of the encrypted password.
So in order to create an
encrypted password, there's advanced technology.
That includes a salt, which is a random salt
some random data, an encryption algorithm
which is held against the password.
And the result is a one-way encrypted cryptostring
that you can see right here.
And I can tell you no worries about it.
There's no way to calculate your original password
from the crypto string.
And then we can see the password settings.
You know what?
The 19059 is that's the number
of days since January 1st, 1970
that this password has been changed.
It's kind of funny to know
but Linux is using January 1st, 1970
as the beginning of time.
And Linux time is calculated in seconds
since that day.
Now in passwords, they fortunately
don't write down the seconds, but they make it days.
So 19, 19059 days, since January, 1970.
Here we can see the minimum password age,
the maximum password age, the password warning,
including the expiration date.
Do you want to memorize all this?
Of course you don't. Use man
on shadow and you will get access to shadow.
That is shadow from section three.
Section three is about library calls.
Definitely not interesting.
I want shadow from section five
because section five is, is about configuration files.
And there we go here
we have the documentation of the shadow file
including all of the options and how they are used.
This one is the most interesting reserved field.
The last field is a reserve field.
This field is reserved for future use.
This has been in the man page since
since I started Linux long time ago.
Alright, now how do we change password?
I'm using pseudo passwd for Anna and
oh, we don't have a user, Anna.
Okay, let's do this Linda now, what do we see?
We see
that the pseudo command is prompting me for a password.
So I need to go once and I need to go twice.
That's annoying, especially if you want to do this
in a script for a hundred users, can you see yourself
typing a hundred different passwords?
I don't think so.
So a much better solution is this echo password pipe passwd
minus minus stdin on Linda,
which is telling me that I need to be root.
Yes, of course.
I need to be root.
I need to be root on the passwd part.
So I'm using echo password.
That's just echoing the text password.
The pipe will receive it in the pseudo passwd command
which is using minus minus stdin and the minus
minus stdin means that the stdin is coming from the pipe.
And you see the result.
The result is I that I'm not prompted in any way.
It's just updating the password.
On Ubuntu the way to do this is slightly different.
Let me first check the, the user names I've got on Ubuntu.
We have user Bill.
Okay. So I'm going to use echo bill colon password
and I'm piping that to sudo chpasswd.
And there we go.
Oh, no, the password fills the dictionary check.
It is based on a dictionary word.
Okay. So we need to make that a little bit more complicated.
You know what random password, there we go.
I don't care about the password for Bill anyway.
By the way what you've seen in action right here is
that Ubuntu is more restrictive regarding passwords.
That's because of a system sitting behind it.
Pam is the name plugable authentication models, and that is
what you can use to configure password complexity demands.
That's not something for discourse, but it's useful to
remember the name plugable authentication models.
That's old.