User & Group Management

Stop useradd from ignoring your system-wide password aging defaults

🧩 The Challenge

Setting up a batch of service accounts only to realize they have no password expiration policy is a classic way to fail a compliance audit. You assume the system settings in login.defs cover you, but useradd often ignores those defaults if you don’t nudge it the right way.

💡 The Fix

Use the defaults flag with useradd so the binary actually respects the values you spent time configuring in etc/login.defs. It ensures you don’t end up with accounts that have passwords valid until the end of time.

useradd -D -f 90
useradd -m newuser

⚙️ Why It Works

Passing -f to the default settings command forces the system to apply that specific shadow file aging limit to every subsequent user you create. That small tweak keeps your security policy consistent without needing a massive post-creation loop.

🚀 Pro-Tip: Check your /etc/login.defs before you go on a user-creating spree, or you are just setting yourself up for rework later.

Linux Tips & Tricks | © ngelinux.com | 8/4/2026