You have just reset the password of the account `erin` to a temporary value and now want her forced to choose a new one the very next time she logs in, while leaving the account otherwise usable. Select the TWO commands that achieve this.
LPIC-1 Exam 102-500, objective 107. Administrative tasks medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Choose 2.
Correct passwd -e erin
Correct. -e expires the password immediately, so the next authentication succeeds and is then required to run through a password change before the session proceeds.
Correct chage -d 0 erin
Correct. -d sets the date of the last password change, and a value of 0 means 1970-01-01, which every ageing calculation treats as long overdue. It is the same effect written into the third field of /etc/shadow directly.
Not correct passwd -l erin
Wrong. -l locks the password by prefixing its stored hash so that nothing can match it. Erin cannot log in at all and so never reaches a change prompt.
Not correct chage -E 0 erin
Wrong. -E sets the account expiry date, and 0 means 1970-01-01, so the account is disabled outright rather than prompting for a new password.
Not correct passwd -d erin
Wrong, and dangerous. -d deletes the password, leaving the field empty. Depending on the PAM configuration that can allow login with no password at all, and it prompts for nothing.
Why
Both keyed commands write the same state: a last-change date already in the past, which login's PAM stack reads as an expired password and answers with a mandatory change. Distinguish the three verbs that all look like disabling an account: expiring a password forces a change, locking a password makes authentication impossible while preserving the hash, and deleting a password removes it. `chage -l erin` shows which of them is currently in force.
Where this comes from
- Cited
- manual page passwd(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 107 and space the ones you get wrong.
More questions on this objective
- The account alice already belongs to the supplementary groups audio and video. You must additionally put her in the group developers while keeping her existing memberships. Which command does that? machine-checked
- A departing employee's account bob must be deleted together with his home directory and mail spool. Which command does all of that in one step? machine-checked
- You want every newly created account to start with a company-standard .bashrc already in its home directory. Where do you place that file? machine-checked
- On a host whose accounts come partly from local files and partly from a directory service, `grep alice /etc/passwd` returns nothing even though `id alice` works. Which command shows alice's account entry the way the system itself resolves it? machine-checked
- Policy says passwords must be changed at least every 90 days, and the account carol must comply. Which command sets that maximum password age? machine-checked
- A line in /etc/group reads `developers:x:1500:alice,bob`. What does the final field contain? machine-checked