In this lesson, you will learn how to enforce proactive security by mandating password rotation and automating account locks for inactive users.
While basic user management allows for creating accounts, a secure environment requires constant vigilance over how long credentials remain valid. By implementing advanced password aging, you minimize the window of opportunity for an attacker to use a compromised credential, and by enforcing inactivity locks, you ensure that "stale" accounts do not become forgotten entry points.
The Mechanism of /etc/shadow
As we covered in previous lessons, the /etc/shadow file holds the sensitive aging information for every user. Specifically, fields 3 through 7 control the life cycle of a password:
- Days since password last changed
- Days before password must be changed (Maximum age)
- Days before password may be changed (Minimum age)
- Days of warning before expiration
- Days of inactivity before account lockout
Practical Enforcement
You can manipulate these settings using the chage command. This tool serves as the interface to modify the aging information in /etc/shadow without manually editing the file, which is prone to error.
To mandate that a user changes their password every 90 days, warns them 7 days in advance, and locks the account if they haven't logged in for 30 days after the password expires, you would run:
sudo chage -M 90 -W 7 -I 30 username
-M 90: Sets the maximum password age to 90 days.-W 7: Sets the warning period to 7 days.-I 30: Disables the account 30 days after the password expires.
By setting these limits, you create a "self-cleaning" security policy. If a user leaves the organization and their account becomes idle, the -I flag ensures the account is rendered unusable without needing manual intervention from an administrator. This proactive approach turns your user management from a static list into a dynamic, hardened defense layer that helps mitigate the risks associated with long-term credential exposure.
Key Takeaway: Automating password rotation and inactivity lockouts via chage reduces the attack surface by ensuring compromised or abandoned credentials have a strictly limited lifespan.