User & Group Management

Stop fighting with user expiration dates in /etc/shadow

🧩 The Challenge

You finally offboard that contractor, but three months later you find their account is still technically valid because you forgot the specific flag to kill the password age. I’ve been burned by this when auditors start poking around asking why inactive accounts are still lingering in the shadow file.

💡 The Fix

Use chage to force an account to expire on a specific date or kill the password validity entirely. It saves you from having to manually scrub entries while you’re trying to keep the server secure.

chage -E 2024-12-31 username

⚙️ Why It Works

Setting the -E flag directly modifies the eighth field in /etc/shadow, which tells the system the absolute date the account becomes unusable. Once that day passes, the login process refuses to authenticate the user regardless of whether the password itself is still correct.

🚀 Pro-Tip: Run chage -l username to verify the expiration status before you assume you’ve actually locked them out.

Linux Tips & Tricks | © ngelinux.com | 10/16/2026