In this tutorial, we will discuss how to change user password in Linux using
passwd command from commandline. In addition, we will also learn how to allow an user to change the password of certain other users via sudo.
What Is passwd Command?
passwd command is used to set and modify a user's password in Linux and Unix-like systems. The
passwd command is not only for setting or changing Linux user's password. We can also use the
passwd command to set password aging, lock and unlock an User account.
The important options of
passwd command are given below:
|Remove the password of an user without deleting the user.|
|Force the user to change the password at next login.|
|Define the number of days after inactivity after the password expiry and before the user account is locked.|
|Lock an user's account.|
|Unlock a locked user account.|
|Specify the number of days that must elapse before the password can be changed.|
|Indicates the maximum number of days of password validity before the user password expires and it must be changed.|
|Display the status information of an user account.|
|Indicates the number of days for which the user gets alerts to change their password before it actually expires.|
In this guide, we only learn about changing the users password in Linux, so we skip examples for the most options. We will publish a detailed guide for
passwd command examples in a separate guide soon.
Change User Password With passwd Command
To change the password of the current user, simply run the
passwd command without any options like below:
Enter the password of the current user and then enter the new password twice to change the password.
Changing password for user ostechnix. Current password: New password: Retype new password: passwd: all authentication tokens updated successfully.
To modify the password of other users, specify the target username (E.g. senthil) after the
passwd command like below:
$ sudo passwd senthil
Please note that the user should be either
root or a member of the
sudo group in-order to modify the password.
Allow Users To Change The Password Of Certain Other Users
What we have learned in the previous section is how to modify the password of the current user and also how to change the password of other users using
passwd command with
What we are going to learn now is permit a specific user to change the password of certain other users. Please note that we want an user to change ONLY the password of the other users, nothing else. The user must not run other commands except the
To put this in simple words, we are going to allow an user to run
passwd command and disallow the same user to run all other commands, even with sudo permission.
This is quite helpful when a teacher wants to change the password of his/her student logins.
Let me show you an example.
I am going to create two users namely user1 and user2 as
# useradd user1
# useradd user2
Set password for the above users:
# passwd user1
# passwd user2
Now, let us allow the user1 to change the password of the user2.
To do so, edit
/etc/sudoers file using command:
Add the following line:
user1 ALL=NOPASSWD: /usr/bin/passwd user2
Make sure you've added the correct path of the
passwd command. As per the above line, the user1 can change the password of the user2 with passwd command without sudo password. Save the file and close it.
Let us verify what are the commands that the user1 can run as root without sudo password:
# sudo -lU user1
Matching Defaults entries for user1 on Almalinux8CT: !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin User user1 may run the following commands on Almalinux8CT: (root) NOPASSWD: /usr/bin/passwd user2
As you can see, the user1 is allowed to run only the
passwd command without sudo password on this machine.
Log out from root user session and log back in as user1.
And run the following command to change the password of user2:
[user1@Almalinux8CT ~]$ sudo passwd user2
Changing password for user user2. New password: BAD PASSWORD: The password is shorter than 8 characters Retype new password: passwd: all authentication tokens updated successfully.
As I stated already, the user1 can only execute the
passwd command, but not the other commands.
Try to run any other command with sudo except the passwd command:
[user1@Almalinux8CT ~]$ sudo dnf update
You will get an error like below:
[sudo] password for user1: Sorry, user user1 is not allowed to execute '/bin/dnf update' as root on Almalinux8CT.
Authorize Password Changes For Multiple Users Via Sudo
In the above example, we authorized password changes via sudo for a single user only i.e. user2 in our case. We can also authorize an user to change the password for multiple users or group of users.
/etc/sudoers file as root:
Add the the
passwd command path along with the user names with comma-separated like below:
user1 ALL=NOPASSWD: /usr/bin/passwd user2, /usr/bin/passwd user3, /usr/bin/passwd user4
As per the above command, the user1 is allowed to change the password of user2, user3 and user4.
You can also authorize an user to change the password of a group of users (E.g. user2 to user5) with wild-cards like below:
user1 ALL=NOPASSWD: /usr/bin/passwd user[2-5]
To authorize password changes for user00, user01, user02,....up to user99, add the following line:
user1 ALL=NOPASSWD: /usr/bin/passwd user[0-9][0-9]
As you can see, changing Linux users password is not that difficult. We can easily modify user's password in Linux using
passwd command in couple seconds. We can also allow an user to change ONLY the password of other user, or group of users. Hope this was useful.
Featured Image Credit - Pexels