Separate observation from modification
First confirm that the name identifies the intended user. Record the original dates without copying password hashes into a report; an administrative change needs a specific target, not just a familiar name.
chage — password and account expiry
Reads and changes local password aging settings and an account expiration date.
Cheat sheet
5 commands Printable version-
chage -l studentinspect your training account -
sudo chage -l labpausedinspect the target account -
getent passwd labpausedinspect UID and shell separately -
sudo passwd -S labpausedinspect password state separately -
sudo chage -E 1970-01-02 labpausedexpire the training account
Overview
chage manages local password aging settings and account expiry. These are
different restrictions: requiring a password change is not the same as
expiring the entire account.
When suspending access, an administrator needs to check several independent properties. Account expiry, password state, shell, SSH keys, and already running processes answer different questions. One successful invocation does not prove the whole outcome.
Options
7-l displays settings, -E sets the account expiration date, and -d sets
the last password change date. -m, -M, and -W control minimum and
maximum password age and advance warnings; -I concerns the period after
password expiry.
The YYYY-MM-DD date format is convenient. Removing expiry with -E -1 is a
separate administrative decision, not a mandatory follow-up to inspection.
Check your version's interface with chage --help.
| Option | What it does | Example |
|---|---|---|
-l --list |
Show the current password-aging and account-expiry settings. | chage -l labpaused |
-E --expiredate date |
Set the date after which the account expires (YYYY-MM-DD). dangerous | sudo chage -E 1970-01-02 labpaused |
-d --lastday date |
Set the date of the last password change (affects password-expiry calculations). | sudo chage -d 2026-01-01 labpaused |
-m --mindays days |
Minimum number of days between password changes. | sudo chage -m 1 labpaused |
-M --maxdays days |
Maximum password age before a forced change. | sudo chage -M 90 labpaused |
-W --warndays days |
How many days before password expiry to warn the user. | sudo chage -W 7 labpaused |
-I --inactive days |
How many days after password expiry the account stays active before being locked. | sudo chage -I 30 labpaused |
Nothing found. Try a shorter query.
Recipes
3Set a past date in a training lab
Only after labpaused has been prepared and the exercise requests it:
Compare the account expiration field before and after. Do not expect this operation to terminate a previously launched program or delete the user's files.
Check the actual access path
The chage report shows local settings. To conclude whether a particular
service permits login, inspect that service's account-handling rules. An SSH
key alone neither bypasses nor guarantees enforcement of those rules.
Troubleshooting
2Password expiry changed instead of account expiry
Compare the fields in sudo chage -l labpaused. Choose the option for the
required property: password age and account expiration are not
interchangeable.
The user resolves but a local change fails
The record may come from an external NSS source. getent displays name
resolution results; that does not prove a matching local shadow entry exists.
Danger zone
Do not apply the illustrated past date to your working account or sole administrator account. It is intended for a prepared training object.
Preserving a home directory does not preserve access, and restricting new logins does not stop old sessions. Verify each requirement separately.
See also
- users-groups — account properties and account sources.
- nologin — refusing execution as a login shell.
- sudo — a separate privilege delegation mechanism.
- ssh-keys — keys as an authentication method.
Found an inaccuracy? Report an error in the article