User & Group Management
Force an immediate password change for your locked out users
🧩 The Challenge
Dealing with a dev who forgot their password is annoying enough, but then they keep trying to log in and trigger account lockouts in PAM. It’s a total waste of time to keep resetting their status manually when they just need a fresh start.
đź’ˇ The Fix
Use chage to manipulate the password expiry directly so they are forced to pick a new one the second they log back in. It saves you from having to set a temporary password that’s insecure and usually gets leaked immediately.
chage -d 0 username⚙️ Why It Works
Setting the “days since last password change” to zero tells the system the password is expired, which triggers the mandatory reset prompt on the very next successful authentication. You’re essentially tricking the login process into treating the account like it’s brand new.
🚀 Pro-Tip: Combine this with a quick look at chage -l username to see if their account is actually set to expire entirely in the near future.
Linux Tips & Tricks | © ngelinux.com | 9/9/2026