1 <!DOCTYPE html PUBLIC
"-//W3C//DTD XHTML 1.0 Strict//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html xmlns=
"http://www.w3.org/1999/xhtml" dir=
"ltr">
5 <meta http-equiv=
"Content-Type" content=
"text/html;charset=utf-8" />
6 <title>Petter Reinholdtsen: Forcing new users to change their password on first login
</title>
7 <link rel=
"stylesheet" type=
"text/css" media=
"screen" href=
"http://people.skolelinux.org/pere/blog/style.css" />
8 <link rel=
"stylesheet" type=
"text/css" media=
"screen" href=
"http://people.skolelinux.org/pere/blog/vim.css" />
15 <a href=
"http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen
</a>
23 <div class=
"title">Forcing new users to change their password on first login
</div>
24 <div class=
"date"> 2nd May
2010</div>
25 <div class=
"body"><p>One interesting feature in Active Directory, is the ability to
26 create a new user with an expired password, and thus force the user to
27 change the password on the first login attempt.
</p>
29 <p>I'm not quite sure how to do that with the LDAP setup in Debian
30 Edu, but did some initial testing with a local account. The account
31 and password aging information is available in /etc/shadow, but
32 unfortunately, it is not possible to specify an expiration time for
33 passwords, only a maximum age for passwords.
</p>
35 <p>A freshly created account (using adduser test) will have these
36 settings in /etc/shadow:
</p>
39 root@tjener:~# chage -l test
40 Last password change : May
02,
2010
41 Password expires : never
42 Password inactive : never
43 Account expires : never
44 Minimum number of days between password change :
0
45 Maximum number of days between password change :
99999
46 Number of days of warning before password expires :
7
50 <p>The only way I could come up with to create a user with an expired
51 account, is to change the date of the last password change to the
52 lowest value possible (January
1th
1970), and the maximum password age
53 to the difference in days between that date and today. To make it
54 simple, I went for
30 years (
30 *
365 =
10950) and January
2th (to
55 avoid testing if
0 is a valid value).
</p>
57 <p>After using these commands to set it up, it seem to work as
61 root@tjener:~# chage -d
1 test; chage -M
10950 test
62 root@tjener:~# chage -l test
63 Last password change : Jan
02,
1970
64 Password expires : never
65 Password inactive : never
66 Account expires : never
67 Minimum number of days between password change :
0
68 Maximum number of days between password change :
10950
69 Number of days of warning before password expires :
7
73 <p>So far I have tested this with ssh and console, and kdm (in
74 Squeeze) login, and all ask for a new password before login in the
75 user (with ssh, I was thrown out and had to log in again).
</p>
77 <p>Perhaps we should set up something similar for Debian Edu, to make
78 sure only the user itself have the account password?
</p>
80 <p>If you want to comment on or help out with implementing this for
81 Debian Edu, please contact us on debian-edu@lists.debian.org.
</p>
83 <p>Update
2010-
05-
02 17:
20: Paul Tötterman tells me on IRC that the
84 shadow(
8) page in Debian/testing now state that setting the date of
85 last password change to zero (
0) will force the password to be changed
86 on the first login. This was not mentioned in the manual in Lenny, so
87 I did not notice this in my initial testing. I have tested it on
88 Squeeze, and '
<tt>chage -d
0 username
</tt>' do work there. I have not
89 tested it on Lenny yet.
</p>
91 <p>Update
2010-
05-
02-
19:
05: Jim Paris tells me via email that an
92 equivalent command to expire a password is '
<tt>passwd -e
93 username
</tt>', which insert zero into the date of the last password
97 <div class=
"tags">Tags:
<a href=
"http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu
</a>,
<a href=
"http://people.skolelinux.org/pere/blog/tags/english">english
</a>,
<a href=
"http://people.skolelinux.org/pere/blog/tags/nuug">nuug
</a>,
<a href=
"http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet
</a>.
</div>
115 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2017/01/">January (
4)
</a></li>
117 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2017/02/">February (
3)
</a></li>
119 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2017/03/">March (
5)
</a></li>
121 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2017/04/">April (
2)
</a></li>
123 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2017/06/">June (
4)
</a></li>
130 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/01/">January (
3)
</a></li>
132 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/02/">February (
2)
</a></li>
134 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/03/">March (
3)
</a></li>
136 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/04/">April (
8)
</a></li>
138 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/05/">May (
8)
</a></li>
140 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/06/">June (
2)
</a></li>
142 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/07/">July (
2)
</a></li>
144 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/08/">August (
5)
</a></li>
146 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/09/">September (
2)
</a></li>
148 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/10/">October (
3)
</a></li>
150 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/11/">November (
8)
</a></li>
152 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2016/12/">December (
5)
</a></li>
159 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/01/">January (
7)
</a></li>
161 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/02/">February (
6)
</a></li>
163 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/03/">March (
1)
</a></li>
165 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/04/">April (
4)
</a></li>
167 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/05/">May (
3)
</a></li>
169 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/06/">June (
4)
</a></li>
171 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/07/">July (
6)
</a></li>
173 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/08/">August (
2)
</a></li>
175 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/09/">September (
2)
</a></li>
177 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/10/">October (
9)
</a></li>
179 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/11/">November (
6)
</a></li>
181 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2015/12/">December (
3)
</a></li>
188 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/01/">January (
2)
</a></li>
190 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/02/">February (
3)
</a></li>
192 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/03/">March (
8)
</a></li>
194 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/04/">April (
7)
</a></li>
196 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/05/">May (
1)
</a></li>
198 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/06/">June (
2)
</a></li>
200 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/07/">July (
2)
</a></li>
202 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/08/">August (
2)
</a></li>
204 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/09/">September (
5)
</a></li>
206 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/10/">October (
6)
</a></li>
208 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/11/">November (
3)
</a></li>
210 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2014/12/">December (
5)
</a></li>
217 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/01/">January (
11)
</a></li>
219 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/02/">February (
9)
</a></li>
221 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/03/">March (
9)
</a></li>
223 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/04/">April (
6)
</a></li>
225 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/05/">May (
9)
</a></li>
227 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/06/">June (
10)
</a></li>
229 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/07/">July (
7)
</a></li>
231 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/08/">August (
3)
</a></li>
233 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/09/">September (
5)
</a></li>
235 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/10/">October (
7)
</a></li>
237 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/11/">November (
9)
</a></li>
239 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2013/12/">December (
3)
</a></li>
246 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/01/">January (
7)
</a></li>
248 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/02/">February (
10)
</a></li>
250 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/03/">March (
17)
</a></li>
252 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/04/">April (
12)
</a></li>
254 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/05/">May (
12)
</a></li>
256 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/06/">June (
20)
</a></li>
258 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/07/">July (
17)
</a></li>
260 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/08/">August (
6)
</a></li>
262 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/09/">September (
9)
</a></li>
264 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/10/">October (
17)
</a></li>
266 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/11/">November (
10)
</a></li>
268 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2012/12/">December (
7)
</a></li>
275 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/01/">January (
16)
</a></li>
277 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/02/">February (
6)
</a></li>
279 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/03/">March (
6)
</a></li>
281 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/04/">April (
7)
</a></li>
283 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/05/">May (
3)
</a></li>
285 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/06/">June (
2)
</a></li>
287 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/07/">July (
7)
</a></li>
289 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/08/">August (
6)
</a></li>
291 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/09/">September (
4)
</a></li>
293 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/10/">October (
2)
</a></li>
295 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/11/">November (
3)
</a></li>
297 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2011/12/">December (
1)
</a></li>
304 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/01/">January (
2)
</a></li>
306 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/02/">February (
1)
</a></li>
308 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/03/">March (
3)
</a></li>
310 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/04/">April (
3)
</a></li>
312 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/05/">May (
9)
</a></li>
314 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/06/">June (
14)
</a></li>
316 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/07/">July (
12)
</a></li>
318 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/08/">August (
13)
</a></li>
320 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/09/">September (
7)
</a></li>
322 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/10/">October (
9)
</a></li>
324 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/11/">November (
13)
</a></li>
326 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2010/12/">December (
12)
</a></li>
333 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/01/">January (
8)
</a></li>
335 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/02/">February (
8)
</a></li>
337 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/03/">March (
12)
</a></li>
339 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/04/">April (
10)
</a></li>
341 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/05/">May (
9)
</a></li>
343 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/06/">June (
3)
</a></li>
345 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/07/">July (
4)
</a></li>
347 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/08/">August (
3)
</a></li>
349 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/09/">September (
1)
</a></li>
351 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/10/">October (
2)
</a></li>
353 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/11/">November (
3)
</a></li>
355 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2009/12/">December (
3)
</a></li>
362 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2008/11/">November (
5)
</a></li>
364 <li><a href=
"http://people.skolelinux.org/pere/blog/archive/2008/12/">December (
7)
</a></li>
375 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (
13)
</a></li>
377 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/amiga">amiga (
1)
</a></li>
379 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/aros">aros (
1)
</a></li>
381 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/bankid">bankid (
4)
</a></li>
383 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (
9)
</a></li>
385 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (
16)
</a></li>
387 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/bsa">bsa (
2)
</a></li>
389 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (
2)
</a></li>
391 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/debian">debian (
149)
</a></li>
393 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (
158)
</a></li>
395 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/debian-handbook">debian-handbook (
3)
</a></li>
397 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/digistan">digistan (
10)
</a></li>
399 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/dld">dld (
16)
</a></li>
401 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/docbook">docbook (
24)
</a></li>
403 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (
4)
</a></li>
405 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/english">english (
349)
</a></li>
407 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (
23)
</a></li>
409 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (
12)
</a></li>
411 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (
30)
</a></li>
413 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (
9)
</a></li>
415 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (
18)
</a></li>
417 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/h264">h264 (
20)
</a></li>
419 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/intervju">intervju (
42)
</a></li>
421 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (
15)
</a></li>
423 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/kart">kart (
20)
</a></li>
425 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/ldap">ldap (
9)
</a></li>
427 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/lenker">lenker (
8)
</a></li>
429 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (
2)
</a></li>
431 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (
1)
</a></li>
433 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (
8)
</a></li>
435 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (
39)
</a></li>
437 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/nice free software">nice free software (
9)
</a></li>
439 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/norsk">norsk (
290)
</a></li>
441 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/nuug">nuug (
189)
</a></li>
443 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (
33)
</a></li>
445 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/open311">open311 (
2)
</a></li>
447 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (
64)
</a></li>
449 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/personvern">personvern (
99)
</a></li>
451 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/raid">raid (
1)
</a></li>
453 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/reactos">reactos (
1)
</a></li>
455 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/reprap">reprap (
11)
</a></li>
457 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/rfid">rfid (
3)
</a></li>
459 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/robot">robot (
10)
</a></li>
461 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/rss">rss (
1)
</a></li>
463 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/ruter">ruter (
5)
</a></li>
465 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (
2)
</a></li>
467 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (
52)
</a></li>
469 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (
4)
</a></li>
471 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (
5)
</a></li>
473 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/standard">standard (
55)
</a></li>
475 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (
6)
</a></li>
477 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (
11)
</a></li>
479 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (
48)
</a></li>
481 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (
3)
</a></li>
483 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/usenix">usenix (
2)
</a></li>
485 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/valg">valg (
8)
</a></li>
487 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/video">video (
59)
</a></li>
489 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (
4)
</a></li>
491 <li><a href=
"http://people.skolelinux.org/pere/blog/tags/web">web (
40)
</a></li>
497 <p style=
"text-align: right">
498 Created by
<a href=
"http://steve.org.uk/Software/chronicle">Chronicle v4.6
</a>