• United States
Unix Dweeb

Using chpasswd to change account passwords on Linux

Nov 04, 20213 mins

The chpasswd command allows Linux admins to change passwords one at a time or many at a time. Here's what you need to watch out for.

The chpasswd command allows admins to change account passwords by piping username and password combinations to it.

This can be done one-account-at-a-time or by putting all of the accounts to be modified in a file and piping the file to the command.

How to use chpasswd

Using the chpasswd command requires root privilege. You can switch to the root account and run a command like this:

# echo nemo:imafish | chpasswd

Better yet, you can use sudo with a command like this:

$ echo skunk:istink! | sudo chpasswd

The usernames and passwords will be in clear text on the command line as shown above, but can also be added to a file like that shown in the two examples below–one running as root, the other using the sudo command:

# cat np                    $ cat np
nemo:imafish                nemo:imafish
lola:imadog                 lola:imadog
skunk:istink!               skunk:istink!
# cat np | chpasswd         $ cat np | sudo chpasswd

If you use a file like that shown, you should use a command like shred that will thoroughly erase and overwrite the file so that it cannot be recovered from the disk afterwards. Clearly, it’s never a good idea to keep passwords in unencrypted form on your system.

If you’re setting up a password for a new account, it will likely not be usable initially and its /etc/shadow file entry will look something like this:

$ sudo grep skunk /etc/shadow

After using the chpasswd command, the entry will change to something like this with the lengthy password hash included:

$ sudo grep skunk /etc/shadow

If you use echo to pipe a username and password to the chpasswd command, the command will likely be recorded in your command history–not a good idea. You could avoid this by disabling the history command’s capture of your commands briefly using this command:

$ set +o history

After running the chpasswd commands that you don’t want recorded, you can reverse that choice like this and return to your normal command history settings:

$ set -o history

If you are changing user passwords, they should be considered temporary, and you should also set the accounts to expire, so users must reset them on their next login. If you are changing passwords for service accounts, ensuring that the passwords cannot be retrieved from the system should be sufficient, as below.

$ sudo passwd -e skunk
Expiring password for user skunk.
passwd: Success

Tweaking history on Linux can help fine-tune what the history command remembers.

Unix Dweeb

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

The opinions expressed in this blog are those of Sandra Henry-Stocker and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author