How to force a password change on next login [LWN.net]

How to force a password change on next login

Posted Aug 8, 2026 13:50 UTC (Sat) by tchernobog (subscriber, #73595)
Parent article: Changes in shadow-utils password-expiration features

If this is getting deprecated:

> the third (date of last password change) [...] and the fifth (maximum password age)

What is the blessed way to force a change of password on the next login, in the case of accounts created with a default password by an administrator?

E.g. on embedded devices, there is often an "admin:admin" user where we set the max password age to 1 to enforce a change.

Other features related to ageing of password are probably fine to deprecate, but this one is very useful in my opinion for stock accounts.

to post comments

How to force a password change on next login

Posted Aug 8, 2026 15:19 UTC (Sat) by alx.manpages (subscriber, #145117) [Link] (3 responses)

The exact deprecation notice in the release notes says:

.sp_lstchg: Restrict to just the values 0 and empty.

The value 0 is what forces a password change in the next login. The only two supported values will be 0 and empty (once that is done, in a few years).

How to force a password change on next login

Posted Aug 8, 2026 15:21 UTC (Sat) by alx.manpages (subscriber, #145117) [Link] (2 responses)

Here's what shadow(5) says now:

     date of last password change
         The date of the last password change, expressed as the number of days
         since 1970-01-01 00:00:00 UTC.

         The value 0 indicates that the user must change their password the
         next time they log in to the system.

         An empty field means that password aging features are disabled.

How to force a password change on next login

Posted Aug 10, 2026 15:28 UTC (Mon) by LionsPhil (subscriber, #121073) [Link] (1 responses)

Does that go for the account expiry date as well? (I see downthread that you're busy enjoying ripping out date-handling code in general.)

Particularly pointing to passwd(1) --lock and its suggestion of usermod(8) --expiredate as the way to actually disable a user account in a world of non-password login methods like SSH keys.

How to force a password change on next login

Posted Aug 10, 2026 16:44 UTC (Mon) by alx.manpages (subscriber, #145117) [Link]

The date of account expiry is documented in shadow(5) as the 8th field.

That field is not deprecated.

I wish we could get rid of all date-handling code, but a little bit remains. Certainly simpler than it once was, though.