MAN page from OpenSuSE pwdutils-3.2.5-2.4.1.x86_64.rpm


Section: User Commands (1)
Updated: November 2005


passwd - change user password 


passwd [-f|-g|-s|-k[-q]] [name]
passwd [-D binddn][-n min][-x max][-w warn][-i inact] account
passwd [-D binddn] {-l|-u|-d|-S[-a]|-e} name
passwd --bioapi [account]
passwd --stdin [account] 


passwd changes passwords for user and group accounts.While an administrator may change the password for any account orgroup, a normal user is only allowed to change the password fortheir own account.passwd also changes account information, such as the full nameof the user, their login shell, password expiry dates and intervalsor disable an account.

passwd is written to work through the PAM API.Essentially, it initializes itself as a "passwd" serviceand utilizes configured "password"modules to authenticate and then update a user's password.

A sample /etc/pam.d/passwd file might look like this:

auth required nullok
account required
password required nullok
password required nullok \

                      use_first_pass use_authtok
session required


Password Changes

If an old password is present, the user is first promted for itand the password is compared agaisnt the stored one. This can bechanged, depending which PAM modules are used.An administrator is permitted to bypass this step so that forgottenpasswords may be changed.

After the user is authenticated, password aging informationare checked to see if the user is permitted to change their passwordat this time. Else passwd refuses to change the password.

The user is then prompted for a replacement password.Care must be taken to not include special control charactersor characters, which are not available on all keyboards.

If the password is accepted,passwd will prompt again and compare the second entryagainst the first.Both entries are require to match in order for the passwordto be changed. 


Change the finger (gecos) information. Thisare the users fullname, office room number, office phonenumber and home phone number. This information is storedin the /etc/passwd file and typically printed byfinger(1)and similiar programs.
With this option, the password for the named group will be changed.
This option is used to change the user login shell. A normaluser may only change the login shell for their own account, thesuper user may change the login shell for any account.
Keep non-expired authentication tokens. The password will onlybe changed if it is expired.
Try to be quiet. This option can only be used with-k.


Password expiry information

-n min
With this option the minimum number of days between passwordchanges is changed. A value of zero for this field indicates thatthe user may change her password at any time. Else the user will not bepermitted to change the password until min days have elapsed.
-x max
With this option the maximum number of days during which apassword is valid is changed. When maxdays plus lastdayis less than the current day, the user will be required to changehis password before being able to use the account.
-w warn
With this option the number of days of warning before a passwordchange is required can be changed. This option is the number ofdays prior to the password expiring that a user will be warnedthe password is about to expire.
-i inact
This option is used to set the number of days of inactivity aftera password has expired before the account is locked. A user whoseaccount is locked must contact the system administrator beforebeing able to use the account again.A value of -1 disables this feature.


Account maintenance

A system administrator can lock the account of the specified user.
A system administrator can unlock the specified account, if theaccount is not passwordless afterwards (it will not unlock anaccount that has only "!" as a password).
The password of the given account can be deleted by the systemadministrator. If the BioAPI interface is used the BioAPI datafor that account is removed.
Report password status on the named account. The first partindicates if the user account is locked (LK), has no password (NP),or has an existing or locked password (PS). The second part gives thedate of the last password change. The next parts are the minimum age,maximum age, warning period, and inactivity period for the password.
Report the password status for all accounts. Can only be used inconjunction with-S.
The user will be forced to change the password at next login.
-P path
Search passwd and shadow file in path. This option cannot beused with changing passwords.
This option is used to indicate that passwd should use theBioAPI for managing the authentication token of an account. It isonly supported with a small subset of other options. This option isnot always available.
This option is used to indicate that passwd should read the newpassword from standard input, which can be a pipe (only by a systemadministrator).

Name service switch options

-D binddn
Use the Distinguished Name binddn to bind to theLDAP directory.


passwd - user account information
shadow - shadow user account information 




Thorsten Kukuk <>



Password Changes
Password expiry information
Account maintenance
Name service switch options

This document was created byman2html,using the manual pages.