passwd

PASSWD(1)                                                            PASSWD(1)



NAME
       passwd - change user password

SYNOPSIS
       passwd [-f|-s] [name]
       passwd [-g] [-r|-R] group
       passwd [-x max] [-n min] [-w warn] [-i inact] login
       passwd {-l|-u|-d|-S|-e} login

DESCRIPTION
       passwd  changes  passwords  for user and group accounts.  A normal user
       may only change the password for his/her own account,  the  super  user
       may  change the password for any account.  The administrator of a group
       may change the password for the group.   passwd  also  changes  account
       information,  such as the full name of the user, user's login shell, or
       password expiry date and interval.

       The -s option makes passwd call chsh to change the user's  shell.   The
       -f  option  makes  passwd call chfn to change the user's gecos informa-
       tion.  These two options are only meant  for  compatiblity,  since  the
       other programs can be called directly.

   Password Changes
       The user is first prompted for his/her old password, if one is present.
       This password is then encrypted and compared against the  stored  pass-
       word.  The user has only one chance to enter the correct password.  The
       super user is permitted to bypass this step so that forgotten passwords
       may be changed.

       After  the  password  has  been  entered, password aging information is
       checked to see if the user is permitted to change the password at  this
       time.  If not, passwd refuses to change the password and exits.

       The user is then prompted for a replacement password.  This password is
       tested for complexity.  As a general guideline, passwords  should  con-
       sist  of 6 to 8 characters including one or more from each of following
       sets:

            Lower case alphabetics

            Upper case alphabetics

            Digits 0 thru 9

            Punctuation marks

       Care must be taken not to include the  system  default  erase  or  kill
       characters.  passwd will reject any password which is not suitably com-
       plex.

       If the password is accepted, passwd will prompt again and  compare  the
       second  entry against the first.  Both entries are required to match in
       order for the password to be changed.

   Group passwords
       When the -g option is  used,  the  password  for  the  named  group  is
       changed.   The  user must either be the super user, or a group adminis-
       trator for the named group.  The current group password is not prompted
       for.   The  -r  option is used with the -g option to remove the current
       password from the named group.  This allows group access  to  all  mem-
       bers.   The  -R option is used with the -g option to restrict the named
       group for all users.

   Password expiry information
       The password aging information may be changed by the  super  user  with
       the -x, -n, -w, and -i options.  The -x option is used to set the maxi-
       mum number of days a password remains valid.  After max days, the pass-
       word is required to be changed.  The -n option is used to set the mini-
       mum number of days before a password may be changed.  The user will not
       be  permitted  to change the password until min days have elapsed.  The
       -w option is used to set the number of days of warning  the  user  will
       receive  before  his/her password will expire.  The warning occurs warn
       days before the expiration, telling the user how many days remain until
       the  password  is  set  to expire.  The -i option is used to disable an
       account after the password has been  expired  for  a  number  of  days.
       After  a  user  account has had an expired password for inact days, the
       user may no longer sign on to the account.

       If you wish to immediately expire an account's password,  you  can  use
       the -e option.  This in effect can force a user to change his/her pass-
       word at the user's next login.  You can  also  use  the  -d  option  to
       delete a user's password (make it empty).  Use caution with this option
       since it can make an account not require a password at  all  to  login,
       leaving your system open to intruders.

   Account maintenance
       User accounts may be locked and unlocked with the -l and -u flags.  The
       -l option disables an account by changing the password to a value which
       matches  no  possible  encrypted  value.   The  -u option re-enables an
       account by changing the password back to its previous value.

       The account status may be viewed with the -S option.  The status infor-
       mation consists of 7 fields.  The first field is the user's login name.
       The second field indicates if the user account is locked  (L),  has  no
       password (NP), or has a usable password (P).  The third field gives the
       date of the last password change.  The next four fields are the minimum
       age,  maximum  age, warning period, and inactivity period for the pass-
       word.  These ages are expressed in days.  See Password expiry  informa-
       tion above for a discussion of these fields.

   Hints for user passwords
       The  security of a password depends upon the strength of the encryption
       algorithm and the size of the key space.  The  UNIX  System  encryption
       method  is based on the NBS DES algorithm and is very secure.  The size
       of the key space depends upon the randomness of the password  which  is
       selected.

       Compromises in password security normally result from careless password
       selection or handling.  For this reason, you should not select a  pass-
       word  which appears in a dictionary or which must be written down.  The
       password should also not be a proper name, your license  number,  birth
       date,  or  street address.  Any of these may be used as guesses to vio-
       late system security.

       Your password must easily remembered so that you will not be forced  to
       write  it  on  a piece of paper.  This can be accomplished by appending
       two small words together and separating each with a  special  character
       or digit.  For example, Pass%word.

       Other  methods  of  construction involve selecting an easily remembered
       phrase from literature and selecting the first or last letter from each
       word.  An example of this is

            Ask not for whom the bell tolls.

       which produces

            An4wtbt.

       You  may  be  reasonably  sure  few crackers will have included this in
       their dictionaries.  You should, however, select your own  methods  for
       constructing  passwords  and  not rely exclusively on the methods given
       here.

   Notes about group passwords
       Group passwords are an inherent security problem since  more  than  one
       person is permitted to know the password.  However, groups are a useful
       tool for permitting co-operation between different users.

CAVEATS
       Not all options may be supported.   Password  complexity  checking  may
       vary from site to site.  The user is urged to select a password as com-
       plex as he feels comfortable with.  Users may not  be  able  to  change
       their  password  on  a system if NIS is enabled and they are not logged
       into the NIS server.

FILES
       /etc/passwd
              User account information

       /etc/shadow
              Encrypted user passwords

SEE ALSO
       group(5), passwd(5) shadow(5)

AUTHOR
       Julianne Frances Haugh <jockgrrl AT ix.com>



                                                                     PASSWD(1)