passwdSet or change a user's password
passwd changes a password: your own after typing the old one, or anyone's when run as root. It also locks, unlocks and expires passwords and shows their status. It is a setuid-root program, which is how a normal user can update the root-only /etc/shadow file.
passwd [-S | -l | -u | -e | -d] [LOGIN]Your password must be rotated and you want to see what passwd checks.
sudoChanging another user's password, or using -l/-u/-e/-d, requires root.
/usr/bin/passwd is owned by root with the setuid bit (-rwsr-xr-x), so it runs with effective UID 0 whoever starts it; it then checks the real UID to decide what you may change. A normal user can only change their own password and must first pass PAM authentication with the current one. passwd hands the work to PAM (/etc/pam.d/passwd, which includes common-password): pam_unix (and pam_pwquality if installed) checks length and complexity, hashes the new password with a random salt using yescrypt on Ubuntu 24.04 (hashes start with $y$; SHA-512 ones start with $6$), and writes it to /etc/shadow by building a new file and renaming it into place. The same shadow line holds the aging fields: day of last change, min, max, warn, inactive and expiry. The plain-text password is never stored anywhere.
A normal user can't write /etc/shadow, yet passwd can: the setuid bit lends it root, and PAM does the checking and hashing.
kunal (UID 1000) has no write permission on /etc/shadow, which is root:shadow mode 640. Still, passwd is going to update it.
(no option)Change a password interactively-SStatus: P (usable), L (locked) or NP (no password), plus aging-lLock the password (prefix the hash with !)-uUnlock a previously locked password-eExpire now: force a change at next login-dDelete the password (passwordless login: dangerous)-a -SStatus of every account-n / -x / -wSet min, max and warning days (same as chage -m/-M/-W)chpasswdCompanion: set passwords non-interactively from user:pass linessudo passwd -d user to 'remove the password so they can use keys'-d leaves an empty password field. With nullok in PAM, anyone can log in with no password at all.
sudo passwd -l user (locks the password; SSH keys still work)echo 'pass' | passwd --stdin user on Ubuntu--stdin is a Red Hat extension; Debian/Ubuntu passwd doesn't have it.
echo 'user:pass' | sudo chpasswdThinking passwd -l fully disables an accountIt only breaks password authentication. SSH keys and running sessions keep working.
sudo usermod -L -e 1 user (expire the account) and kill its sessionsPutting the password on the command line in a script (chpasswd <<< "u:$PW" in a logged CI job)Command lines and CI logs are visible to others; the password leaks.
Read it from a secrets manager into stdin, never echo it, and force a change with passwd -eTry these on a Linux machine of your own. Each task has a hint and a solution.
Show the password status of your own account (devops).
Create user temp4, set its password non-interactively to 'Lab-Pass-123', and force a change at next login.
Lock temp4's password, verify the ! in /etc/shadow, then unlock it.
Prove that passwd is a setuid program.
passwdSet or change a user's password
passwd changes a password: your own after typing the old one, or anyone's when run as root. It also locks, unlocks and expires passwords and shows their status. It is a setuid-root program, which is how a normal user can update the root-only /etc/shadow file.
passwd [-S | -l | -u | -e | -d] [LOGIN]Your password must be rotated and you want to see what passwd checks.
sudoChanging another user's password, or using -l/-u/-e/-d, requires root.
/usr/bin/passwd is owned by root with the setuid bit (-rwsr-xr-x), so it runs with effective UID 0 whoever starts it; it then checks the real UID to decide what you may change. A normal user can only change their own password and must first pass PAM authentication with the current one. passwd hands the work to PAM (/etc/pam.d/passwd, which includes common-password): pam_unix (and pam_pwquality if installed) checks length and complexity, hashes the new password with a random salt using yescrypt on Ubuntu 24.04 (hashes start with $y$; SHA-512 ones start with $6$), and writes it to /etc/shadow by building a new file and renaming it into place. The same shadow line holds the aging fields: day of last change, min, max, warn, inactive and expiry. The plain-text password is never stored anywhere.
A normal user can't write /etc/shadow, yet passwd can: the setuid bit lends it root, and PAM does the checking and hashing.
kunal (UID 1000) has no write permission on /etc/shadow, which is root:shadow mode 640. Still, passwd is going to update it.
(no option)Change a password interactively-SStatus: P (usable), L (locked) or NP (no password), plus aging-lLock the password (prefix the hash with !)-uUnlock a previously locked password-eExpire now: force a change at next login-dDelete the password (passwordless login: dangerous)-a -SStatus of every account-n / -x / -wSet min, max and warning days (same as chage -m/-M/-W)chpasswdCompanion: set passwords non-interactively from user:pass linessudo passwd -d user to 'remove the password so they can use keys'-d leaves an empty password field. With nullok in PAM, anyone can log in with no password at all.
sudo passwd -l user (locks the password; SSH keys still work)echo 'pass' | passwd --stdin user on Ubuntu--stdin is a Red Hat extension; Debian/Ubuntu passwd doesn't have it.
echo 'user:pass' | sudo chpasswdThinking passwd -l fully disables an accountIt only breaks password authentication. SSH keys and running sessions keep working.
sudo usermod -L -e 1 user (expire the account) and kill its sessionsPutting the password on the command line in a script (chpasswd <<< "u:$PW" in a logged CI job)Command lines and CI logs are visible to others; the password leaks.
Read it from a secrets manager into stdin, never echo it, and force a change with passwd -eTry these on a Linux machine of your own. Each task has a hint and a solution.
Show the password status of your own account (devops).
Create user temp4, set its password non-interactively to 'Lab-Pass-123', and force a change at next login.
Lock temp4's password, verify the ! in /etc/shadow, then unlock it.
Prove that passwd is a setuid program.