Linux(Centos 7.6)命令详解：passwd

1.命令作用

更新用户身份验证令牌(update user's authentication tokens)，即修改用户密码

2.命令语法

Usage: passwd [OPTION...] <accountName>

3.参数详解

OPTION:

• -k, --keep-tokens，保留未过期的身份验证令牌
• -d, --delete，删除指定帐户的密码(root only)
• -l, --lock，锁定指定帐户的密码(root only)
• -u, --unlock，解锁指定帐户的密码(root only)
• -e, --expire，指定帐户的密码过期(root only)
• -f, --force，强制运行
• -x, --maximum=DAYS，最大密码生存期(root only)
• -n, --minimum=DAYS，最小密码生存期(root only)
• -w, --warning=DAYS，用户在密码过期前收到警告的天数(root only)
• -i, --inactive=DAYS，密码过期后多少天禁用用户(root only)
• -S, --status，报告指定帐户的密码状态(root only)
• --stdin，从stdin中读取新的令牌(root only)

HELP OPTION:

• -?, --help，显示帮助信息
• --usage，显示简短的使用信息

4.常用用例

4.1.保留未过期的身份验证令牌

[root@node1 ~]# passwd -k user1
Changing password for user user1.
Changing password for user1.
(current) UNIX password:                                    # 输入用户现在的密码
New password:                                               # 输入用户新密码
Retype new password:                                        # 重新输入用户新密码
passwd: expired authentication tokens updated successfully.
[root@node1 ~]# 

# passwd user2 执行/var/log/secure里面的信息
Jun 10 22:07:42 node1 passwd: pam_unix(passwd:chauthtok): password changed for user2
Jun 10 22:07:42 node1 passwd: gkr-pam: couldn't update the login keyring password: no old password was entered

# passwd -k user2 执行/var/log/secure里面的信息
Jun 10 22:10:10 node1 passwd: pam_unix(passwd:chauthtok): password changed for user2
Jun 10 22:10:10 node1 passwd: The gnome keyring socket is not owned with the same credentials as the user login: /run/user/0/keyring/control
Jun 10 22:10:10 node1 passwd: gkr-pam: couldn't change password for the login keyring.

4.2.删除用户密码

[root@node1 ~]# cat /etc/shadow | grep user1
user1:$1$A5YK28Zi$qTQ2R16k1yiSM72AztOvo/:20249:0:99999:7:::
[root@node1 ~]# passwd -d user1
Removing password for user user1.
passwd: Success
[root@node1 ~]# cat /etc/shadow | grep user1
user1::20249:0:99999:7:::
[root@node1 ~]# 

4.3.锁定/解锁用户密码

[root@node1 ~]# cat /etc/shadow | grep user1
user1:$1$GWVxhbwK$ZLQC9nPH2VtXnUBiPJWJ4/:20249:0:99999:7:::
[root@node1 ~]# passwd -l user1      # 锁定用户密码，会在第二列加密密码前家两个感叹号!!，用户通过密码登录会失败
Locking password for user user1.
passwd: Success
[root@node1 ~]# cat /etc/shadow | grep user1
user1:!!$1$GWVxhbwK$ZLQC9nPH2VtXnUBiPJWJ4/:20249:0:99999:7:::
[root@node1 ~]# 
[root@node1 ~]# passwd -u user1      # 解锁用户密码
Unlocking password for user user1.
passwd: Success
[root@node1 ~]# cat /etc/shadow | grep user1
user1:$1$GWVxhbwK$ZLQC9nPH2VtXnUBiPJWJ4/:20249:0:99999:7:::
[root@node1 ~]# 

4.4.修改用户密码为过期

# 会话一
[root@node1 ~]# passwd -e user1     # 使得用户密码过期
Expiring password for user user1.
passwd: Success
[root@node1 ~]# 
[root@node1 ~]# chage -l user1      # chage查看会提示需要修改密码
Last password change					            : password must be changed
Password expires					                : password must be changed
Password inactive					                : password must be changed
Account expires						                : never
Minimum number of days between password change		: 0
Maximum number of days between password change		: 99999
Number of days of warning before password expires	: 7
[root@node1 ~]# 

# 会话二，这里user2执行用户切换可修改密码，该验证方法是错误的
[user2@node1 ~]$ su - user1
Password: 
You are required to change your password immediately (root enforced)
Changing password for user1.
(current) UNIX password: 
New password: 
Retype new password: 
Last login: Tue Jun 10 22:27:21 CST 2025 on pts/0
[user1@node1 ~]$

# 会话三，通过ssh到user2，这里可验证到密码过期
[root@node1 ~]# ssh user2@node1
user2@node1's password: 
Last login: Tue Jun 10 22:28:01 2025
[user2@node1 ~]$ su - user1
Password: 
su: Authentication failure
[user2@node1 ~]$ 

4.5.修改用户密码策略信息

[root@node1 ~]# chage -l user1
Last password change					            : Jun 10, 2025
Password expires					                : never
Password inactive					                : never
Account expires						                : never
Minimum number of days between password change		: 0
Maximum number of days between password change		: 99999
Number of days of warning before password expires	: 7
[root@node1 ~]# 
[root@node1 ~]# passwd -x 88888 user1     # 修改密码的最大有效期
Adjusting aging data for user user1.
passwd: Success
[root@node1 ~]# passwd -n 8 user1         # 修改密码的最小时间间隔
Adjusting aging data for user user1.
passwd: Success
[root@node1 ~]# passwd -w 14 user1        # 修改密码过期前警告天数
Adjusting aging data for user user1.
passwd: Success
[root@node1 ~]# chage -l user1
Last password change					            : Jun 10, 2025
Password expires					                : never
Password inactive					                : never
Account expires						                : never
Minimum number of days between password change		: 8
Maximum number of days between password change		: 88888
Number of days of warning before password expires	: 14
[root@node1 ~]# 

# 除了可以chage -l user1查看用户密码策略信息，还可以使用如下命令查看
[root@node1 ~]# passwd -S user1
user1 PS 2025-06-10 8 88888 14 -1 (Password set, MD5 crypt.)
[root@node1 ~]# cat /etc/shadow | grep user1
user1:$1$m76LJ6f9$TJxSEq0e5a0DgnmWUFm9H0:20249:8:88888:14:::
[root@node1 ~]# 

4.5.修改用户密码过期后多少天禁用用户

[root@node1 ~]# passwd -S user1     # 也可以使用cat /etc/shadow | grep user1查看
user1 PS 2025-06-10 8 88888 14 -1 (Password set, MD5 crypt.)
[root@node1 ~]# passwd -i 7 user1
Adjusting aging data for user user1.
passwd: Success
[root@node1 ~]# passwd -S user1
user1 PS 2025-06-10 8 88888 14 7 (Password set, MD5 crypt.)
[root@node1 ~]# 

4.6.修改用户密码

# 方式一: 交互式方式修改密码(需要输入两次，该方式更安全)
[root@node1 ~]# passwd user1
Changing password for user user1.
New password: 
BAD PASSWORD: The password fails the dictionary check - it does not contain enough DIFFERENT characters
Retype new password: 
passwd: all authentication tokens updated successfully.
[root@node1 ~]# 

# 方式二: 非交互式修改密码(该方式简单，但不安全)
[root@node1 ~]# echo 'passqwer' | passwd --stdin user1
Changing password for user user1.
passwd: all authentication tokens updated successfully.
[root@node1 ~]#