How to force a password change on next login [LWN.net]

How to force a password change on next login

Posted Aug 8, 2026 15:19 UTC (Sat) by alx.manpages (subscriber, #145117)
In reply to: How to force a password change on next login by tchernobog
Parent article: Changes in shadow-utils password-expiration features

The exact deprecation notice in the release notes says:

.sp_lstchg: Restrict to just the values 0 and empty.

The value 0 is what forces a password change in the next login. The only two supported values will be 0 and empty (once that is done, in a few years).

to post comments

How to force a password change on next login

Posted Aug 8, 2026 15:21 UTC (Sat) by alx.manpages (subscriber, #145117) [Link] (2 responses)

Here's what shadow(5) says now:

     date of last password change
         The date of the last password change, expressed as the number of days
         since 1970-01-01 00:00:00 UTC.

         The value 0 indicates that the user must change their password the
         next time they log in to the system.

         An empty field means that password aging features are disabled.

How to force a password change on next login

Posted Aug 10, 2026 15:28 UTC (Mon) by LionsPhil (subscriber, #121073) [Link] (1 responses)

Does that go for the account expiry date as well? (I see downthread that you're busy enjoying ripping out date-handling code in general.)

Particularly pointing to passwd(1) --lock and its suggestion of usermod(8) --expiredate as the way to actually disable a user account in a world of non-password login methods like SSH keys.

How to force a password change on next login

Posted Aug 10, 2026 16:44 UTC (Mon) by alx.manpages (subscriber, #145117) [Link]

The date of account expiry is documented in shadow(5) as the 8th field.

That field is not deprecated.

I wish we could get rid of all date-handling code, but a little bit remains. Certainly simpler than it once was, though.