passwd (change password) in Linux CLI - Deep Dive

Overview - passwd (change password)

What is it?

The passwd command in Linux is used to change a user's password. It prompts the user to enter the current password and then the new password twice to confirm. This command helps keep user accounts secure by allowing password updates. It works for both regular users and administrators managing other accounts.

Why it matters

Passwords protect user accounts from unauthorized access. Without the ability to change passwords easily, accounts could become vulnerable to attacks or misuse. The passwd command ensures users can update their credentials regularly, maintaining system security and privacy. Without it, managing user access would be risky and cumbersome.

Where it fits

Before learning passwd, you should understand basic Linux commands and user accounts. After mastering passwd, you can explore user management commands like useradd, usermod, and group management. This fits into the broader topic of Linux system administration and security.

Mental Model

Core Idea

The passwd command securely updates a user's password by verifying the old password and confirming the new one.

Think of it like...

Changing your password with passwd is like changing the lock on your front door: you must prove you own the key first, then set a new key that only you know.

┌───────────────┐
│ User runs     │
│ 'passwd'      │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Prompt: Enter │
│ current pwd   │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Prompt: Enter │
│ new pwd       │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Prompt: Re-   │
│ enter new pwd │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Password      │
│ updated       │
└───────────────┘

Build-Up - 6 Steps

1

Foundation

Basic passwd command usage

Concept: Learn how to run the passwd command to change your own password.

Open a terminal and type 'passwd'. The system will ask for your current password, then ask you to enter a new password twice. If both new passwords match and meet security rules, your password changes.

Result

You successfully change your user password after confirming the new password.

Knowing the basic flow of passwd helps you understand how Linux protects password changes by verifying identity and confirming new credentials.

2

Foundation

Password confirmation and security rules

Concept: Understand why passwd asks for the new password twice and enforces rules.

When you enter a new password, passwd asks you to type it again to avoid typos. It also checks password strength like length and complexity based on system policies to keep accounts secure.

Result

Password change only succeeds if both entries match and meet security requirements.

This double-entry and validation prevent accidental lockouts and weak passwords, which are common security risks.

3

Intermediate

Changing another user's password as root

🤔Before reading on: do you think a normal user can change another user's password with passwd? Commit to yes or no.

Concept: Learn how system administrators can change passwords for other users using passwd with elevated privileges.

If you are root or have sudo rights, you can run 'sudo passwd username' to change another user's password without knowing their current password. This is useful for account recovery or setup.

Result

The specified user's password is updated after entering the new password twice.

Understanding privilege levels clarifies why normal users must know their current password, but admins can override this to manage accounts.

4

Intermediate

Password expiration and forced change

🤔Before reading on: do you think passwd can force a user to change password at next login? Commit to yes or no.

Concept: Explore how passwd can set password expiration policies to improve security.

Using 'passwd -e username', an admin can expire a user's password immediately, forcing them to choose a new one at next login. This helps enforce regular password updates.

Result

User must change password on next login due to expiration.

Knowing how to enforce password changes helps maintain strong security hygiene across users.

5

Advanced

Understanding PAM integration with passwd

🤔Before reading on: do you think passwd works alone or relies on other system components? Commit to your answer.

Concept: Learn that passwd uses PAM (Pluggable Authentication Modules) to handle password policies and authentication.

When you run passwd, it calls PAM modules configured in /etc/pam.d/passwd. These modules enforce password complexity, history, and lockout rules. This modular design allows flexible security policies.

Result

Password changes respect system-wide security rules defined by PAM.

Understanding PAM's role reveals how passwd adapts to different security needs without changing the command itself.

6

Expert

Security risks and mitigation with passwd

🤔Before reading on: do you think passwd can be exploited if misconfigured? Commit to yes or no.

Concept: Examine potential security pitfalls with passwd and how to avoid them.

If PAM or passwd permissions are misconfigured, attackers might bypass password checks or escalate privileges. For example, weak PAM rules or writable passwd binaries can be exploited. Regular audits and strict permissions prevent this.

Result

A secure system prevents unauthorized password changes and privilege escalation.

Knowing these risks helps admins harden systems and avoid common security mistakes that could compromise user accounts.

Under the Hood

The passwd command interacts with system authentication files like /etc/shadow, which stores encrypted passwords. It uses PAM to apply authentication and password policies. When changing a password, passwd verifies the current password by checking the encrypted hash, then updates the hash with the new password after validation. This process ensures passwords are never stored or transmitted in plain text.

Why designed this way?

passwd was designed to separate user interaction from authentication logic by using PAM, allowing flexible security policies without changing the command. Storing encrypted passwords in /etc/shadow protects them from casual access. The double-entry and verification steps reduce user errors and improve security.

┌───────────────┐
│ User runs     │
│ 'passwd'      │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ passwd calls  │
│ PAM modules   │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ PAM checks    │
│ current pwd   │
│ against       │
│ /etc/shadow   │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ PAM enforces  │
│ password      │
│ policies      │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ /etc/shadow   │
│ updated with  │
│ new password  │
│ hash          │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Can a normal user change another user's password with passwd? Commit to yes or no.

Common Belief: A normal user can change any user's password by running 'passwd username'.

Reality: Only root or users with sudo privileges can change other users' passwords without knowing their current password.

Why it matters: Believing this can lead to failed attempts and confusion about permissions, potentially causing security concerns if users try unsafe workarounds.

Quick: Does passwd store your password in plain text? Commit to yes or no.

Common Belief: passwd saves the new password as plain text in system files.

Reality: passwd stores only encrypted (hashed) versions of passwords in /etc/shadow, never plain text.

Why it matters: Misunderstanding this can cause unnecessary fear or misuse of password files, risking system security.

Quick: Does entering mismatched new passwords still change your password? Commit to yes or no.

Common Belief: If you mistype the new password confirmation, passwd still changes your password.

Reality: passwd requires both new password entries to match exactly; otherwise, it aborts the change.

Why it matters: This prevents accidental lockouts and ensures users know their new password.

Quick: Can passwd bypass system password policies? Commit to yes or no.

Common Belief: passwd ignores system password complexity and expiration policies.

Reality: passwd enforces policies through PAM modules, so it respects system-wide rules.

Why it matters: Ignoring this leads to weak passwords and security vulnerabilities.

Expert Zone

1

passwd's behavior depends heavily on PAM configuration, which can vary widely between Linux distributions and environments.

2

The encrypted password hashes in /etc/shadow use different algorithms (e.g., SHA-512), and passwd adapts to these automatically.

3

Using passwd in scripts requires careful handling of input and permissions to avoid security risks or automation failures.

When NOT to use

passwd is not suitable for bulk password changes or automated user provisioning; tools like chpasswd or usermod with scripting are better. Also, passwd cannot manage password policies alone; PAM and other tools are needed for comprehensive security.

Production Patterns

In production, passwd is used interactively by users and admins for individual password changes. Automated systems use PAM-aware scripts or centralized authentication services (LDAP, Kerberos) that integrate with passwd for consistent security.

Connections

PAM (Pluggable Authentication Modules)

passwd relies on PAM to enforce authentication and password policies.

Understanding PAM helps grasp how passwd adapts to different security requirements without changing its interface.

Hash Functions in Cryptography

passwd stores passwords as cryptographic hashes to protect them.

Knowing how hashing secures passwords clarifies why passwd never stores or shows plain text passwords.

Physical Security Locks

Both passwd and physical locks require proof of ownership before granting access.

This cross-domain connection highlights the universal principle of verifying identity before allowing changes.

Common Pitfalls

#1 Trying to change another user's password without root privileges.

Wrong approach:

passwd otheruser

Correct approach:

sudo passwd otheruser

Root cause:

Misunderstanding user permissions and the need for administrative rights.

#2 Entering mismatched new passwords and expecting the change to succeed.

Wrong approach:

Type new password 'abc123' and confirmation 'abc124' during passwd prompt.

Correct approach:

Ensure both new password entries match exactly before pressing enter.

Root cause:

Not realizing passwd requires exact confirmation to prevent errors.

#3 Running passwd in a script without handling input securely.

Wrong approach:

echo 'newpassword' | passwd username

Correct approach:

Use 'chpasswd' or PAM-aware tools designed for scripting password changes.

Root cause:

Lack of understanding about passwd's interactive design and security implications.

Key Takeaways

The passwd command securely changes user passwords by verifying the current password and confirming the new one.

It relies on PAM modules to enforce password policies and system security rules.

Only users with proper permissions can change other users' passwords, protecting account integrity.

Password changes require careful confirmation to avoid mistakes and lockouts.

Understanding passwd's integration with system security helps prevent common mistakes and vulnerabilities.

Practice

1. What does the passwd command do in Linux?

easy

A. It changes the password of a user securely.

B. It lists all users on the system.

C. It creates a new user account.

D. It deletes a user account.

Solution

1. Step 1: Understand the purpose of passwd

   The passwd command is designed to change user passwords securely on Linux systems.

2. Step 2: Compare options with command function

   Options B, C, and D relate to user management but not password changes. Only It changes the password of a user securely. correctly describes passwd.

3. Final Answer:

   It changes the password of a user securely. -> Option A

4. Quick Check:

   passwd changes passwords = A [OK]

Hint: Remember: passwd is for changing passwords only [OK]

Common Mistakes:

• Confusing passwd with user creation commands
• Thinking passwd lists users
• Assuming passwd deletes accounts

2. Which of the following is the correct syntax to change the password for user alice as root?

easy

A. passwd -p alice

B. passwd -u alice

C. passwd --change alice

D. passwd alice

Solution

1. Step 1: Recall root usage of passwd

   Root can change any user's password by running passwd username.

2. Step 2: Analyze options for correct syntax

   Only passwd alice uses the correct syntax. Options A, B, and C use invalid or non-existent flags.

3. Final Answer:

   passwd alice -> Option D

4. Quick Check:

   Root changes user password with passwd username = D [OK]

Hint: Use passwd username as root to change others' passwords [OK]

Common Mistakes:

• Adding wrong flags like -u or -p
• Using --change which is not a valid option
• Trying to change password without specifying username as root

3. What will happen if a normal user runs the command passwd root?

medium

A. The root password will be changed immediately.

B. The user will be prompted to enter the current root password.

C. The command will fail with a permission error.

D. The user's own password will be changed instead.

Solution

1. Step 1: Understand user permissions for passwd

   Only root can change other users' passwords. Normal users cannot change root's password.

2. Step 2: Predict command behavior for normal user

   When a normal user tries passwd root, the system denies permission and shows an error.

3. Final Answer:

   The command will fail with a permission error. -> Option C

4. Quick Check:

   Normal user cannot change root password = A [OK]

Hint: Only root can change other users' passwords; others get permission error [OK]

Common Mistakes:

• Assuming normal user can change root password
• Thinking user will be asked root's current password
• Believing user's own password changes instead

4. You run passwd alice as root but get the error: passwd: Authentication token manipulation error. What is the most likely cause?

medium

A. The password entered does not meet complexity rules.

B. You forgot to run the command with sudo or as root.

C. The user alice does not exist.

D. The passwd command is not installed.

Solution

1. Step 1: Understand the error meaning

   The error usually means insufficient permissions to update password files.

2. Step 2: Identify cause based on command context

   If not run as root or with sudo, passwd cannot change another user's password, causing this error.

3. Final Answer:

   You forgot to run the command with sudo or as root. -> Option B

4. Quick Check:

   Permission error means missing root privileges = C [OK]

Hint: Run passwd with root or sudo to avoid permission errors [OK]

Common Mistakes:

• Assuming user does not exist without checking
• Thinking password complexity causes this error
• Believing passwd is missing from system

5. You want to automate changing passwords for multiple users listed in a file users.txt. Which script snippet correctly changes each user's password to NewPass123 using passwd?

hard

A. for user in $(cat users.txt); do echo -e "NewPass123\nNewPass123" | passwd $user; done

B. while read user; do echo "NewPass123" | passwd --stdin $user; done < users.txt

C. for user in users.txt; do passwd $user NewPass123; done

D. cat users.txt | passwd -p NewPass123

Solution

1. Step 1: Understand how to feed password to passwd

   The passwd command reads password from standard input when piped, requiring password twice (new and confirmation).

2. Step 2: Analyze each script snippet

   while read user; do echo "NewPass123" | passwd --stdin $user; done < users.txt uses --stdin which is not standard on all systems. for user in $(cat users.txt); do echo -e "NewPass123\nNewPass123" | passwd $user; done correctly uses echo -e to send password twice piped to passwd. for user in users.txt; do passwd $user NewPass123; done incorrectly treats file name as user list. cat users.txt | passwd -p NewPass123 misuses passwd with pipe and -p which is invalid.

3. Final Answer:

   for user in $(cat users.txt); do echo -e "NewPass123\nNewPass123" | passwd $user; done -> Option A

4. Quick Check:

   Pipe password twice to passwd in loop = B [OK]

Hint: Pipe password twice with echo -e inside loop to automate [OK]

Common Mistakes:

• Using non-standard --stdin option
• Not sending password twice for confirmation
• Treating filename as username list without reading
• Misusing passwd options