Setting and changing a user password in Linux (passwd)

How do you set or change a password? How do you change a user's or administrator's password? The passwd command is used for this. You will learn how to use the passwd command in the next paragraph. Remember that for security reasons, you should always change the default password for your account. It is also important for the new password to be complex enough that it cannot be cracked quickly. People are generally not very good at coming up with passwords, so I recommend using a password manager, especially Bitwarden.

The passwd command updates the user's token stored in the /etc/shadow file. A regular user can only change their own password, a user with superuser privileges (or root) can change the password of any account, and a group administrator can change the password for a group.

Setting a user's password

To do this, use the command

passwd

You will be asked to enter your old password, if one exists. Then you will need to enter the new password and confirm it. The password will be hidden, which means you will not see it as you type, but don't worry — it will still be entered correctly.

Changing another user's password

As the root user, you can set a password for any other user as follows:

passwd <user>

If you are using an account with superuser privileges, you must use the sudo command.

sudo passwd <user>

Changing a group password

Changing a group password works in a similar way, but uses the -g parameter.

gpasswd <group>

Forcing a user to change their password

By default, a user's password never expires. To force a password change, you must have superadmin privileges or a root account. To force the change, enter the following as root:

passwd -e <user>

Or use sudo with an account that has superuser privileges.

sudo passwd -e <user>

From now on, the user will be forced to enter a new password after logging in.

Locking a user account

The passwd command can also lock (and unlock) user accounts. The command changes the user's token to one that cannot be generated from any supplied password — it inserts an exclamation mark (!) at the beginning of the token in the /etc/shadow file. In practice, locking the account means that it is no longer possible to log in to it. You have to admit, that's quite a clever solution! Use the -l flag to lock an account and the -u flag to unlock it.

To lock a user account, enter the following as root:

passwd -l <user>

or from a superuser account

sudo passwd -l <user>

To unlock a locked user account, enter the following as root:

passwd -u <user>

or from a superuser account

sudo passwd -u <user>

Security!

To learn more about secure password policies, see this short guide from niebezpiecznik.pl.