Set Password-Aging Rules

The school has a policy for how long a password may remain in use. Password aging records describe that policy: a maximum age, warnings and other timing fields. chage can inspect and modify those settings for an account.

Do not confuse a password's age with the account's expiration date. One can require a person to update a credential while keeping the account; the other can restrict the account itself. We will set one specific field and then read the policy back.

What you’ll learn

Set and inspect password-age policy with chage.
Distinguish password expiration from account expiration.

Password lifetime runs from its last change

1
Last change
The password has a recorded change date.
```
starting date
```
→2
Maximum age
chage -M sets a limit measured in days.
```
90 days
```
→3
Policy result
Password expiry follows that age policy; account expiration is a separate date.
```
password may need renewal
```

Choose the aging field that matches the intended policy and read it back afterward.

Set and inspect a 90-day maximum password age

Prepare the example

Use a disposable VM and the existing practice account with administrative authorization. Inspect its current aging information before changing it. This example demonstrates a configured limit, not a recommendation that every organization should use the same password policy.

Bash · Linux terminal

sudo chage -M 90 school-assistant
sudo chage -l school-assistant

Expected behavior; machine-dependent details

Aging details vary with existing dates and locale.

chage -M 90 school-assistant sets the maximum password age to 90 days. That age is interpreted with the recorded last password change, not simply as '90 days from whenever I typed this command.' Other aging settings can affect warnings or subsequent access.

chage -l school-assistant displays the account's aging information. Read each label rather than treating every date as an account-deletion deadline. The account expiration field is separate. Whether and how a login path enforces the configured values also depends on authentication configuration, so verify behavior in the system where the policy will be used.

Inspect the account aging fields

chage manages password-aging information for Linux accounts. Administrators use it to decide how long a password remains valid and when users should be warned before expiry.

What is `chage`?

The chage command lets you view and update the password aging information for a user. You can control things like how often a user must change their password, how long before it expires they get a warning, and more.

Step 1: Check If `chage` Is Installed

Most Linux distros come with chage pre-installed. Just to be sure, run:

which chage

/usr/bin/chage

If it doesn't show a path, you may need to install the passwd or shadow-utils package depending on your distro.

Step 2: View Current Expiry Settings for a User

Let’s say you want to check expiry details for a user named john:

sudo chage -l john

Last password change                                    : Jul 02, 2025
Password expires                                        : Sep 30, 2025
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 90
Number of days of warning before password expires       : 7

This output tells you when the password was last changed, when it will expire, and more.

Choose maximum age, warnings or account expiration

Step 3: Set Password Expiry Rules

Now let’s set some rules for our user john.

Set the maximum number of days a password remains valid (e.g., 60 days):

sudo chage -M 60 john

Set the minimum number of days before a user can change password again (e.g., 1 day):

sudo chage -m 1 john

Set the number of days before password expiry to warn the user (e.g., 5 days):

sudo chage -W 5 john

Set account expiration date (e.g., disable account after Oct 31, 2025):

sudo chage -E 2025-10-31 john

You can combine multiple options in one command too:

sudo chage -M 60 -m 1 -W 5 -E 2025-10-31 john

Step 4: Confirm the Changes

After setting the rules, verify them again:

sudo chage -l john

This helps confirm your new password aging policy has taken effect.

Why This Matters

Regularly expiring passwords is a critical step in securing user accounts — especially on multi-user or production Linux servers. With chage, you’re in full control of password policies!

And that's it! You're now ready to enforce password aging rules using chage.

Try it, then check the worked answer

Your task: What does chage -M 90 configure?

Use a disposable VM and the existing practice account with administrative authorization. Inspect its current aging information before changing it. This example demonstrates a configured limit, not a recommendation that every organization should use the same password policy.

Bash · complete example for this question

sudo chage -M 90 school-assistant
sudo chage -l school-assistant

Expected behavior; machine-dependent details

Aging details vary with existing dates and locale.

Worked answer

A maximum password age of 90 days.

-M 90 means a maximum password age of 90 days. It does not schedule a backup and is not the same option as account expiration. Inspect the resulting labels to see exactly which policy field changed.

Password age and account expiry are different settings

Choose the aging field that matches the intended policy and read it back afterward. Keep last change, maximum age, warnings and account expiration separate. A demonstration value is not a universal security policy; apply the settings your environment actually requires.

Reaching the recap and completing the quizzes are separate milestones.

Next lesson: Lock Password Authentication →

Set Password-Aging Rules