passwd Command: Lock Linux Accounts and Enforce Password Policy

What is passwd?

The passwd command manages user account passwords and authentication policy on Linux. Beyond simply changing passwords, it controls account locking, password expiry, and minimum/maximum age enforcement — all of which are critical security controls on production servers. For incident response, passwd -l username is the fastest way to disable a compromised account without deleting it, preserving its files and process ownership for forensic examination while immediately blocking interactive logins. For hardening, applying passwd -l to all service accounts ensures that accounts used only for running services cannot be used for interactive login even if credentials are somehow obtained or enumerated.

Syntax

passwd [options] [username]
passwd                          # Change current user's password
passwd username                 # Change another user's password (root only)
passwd -l username              # Lock account
passwd -u username              # Unlock account
passwd -e username              # Force password change at next login
passwd -S username              # Show account status

Without arguments, passwd changes the calling user’s own password. With a username argument (root-only), it modifies another account. The -l (lock) and -u (unlock) flags are the most security-relevant options for incident response. passwd -S shows the current status — locked, expired, or active.

Key Options and Flags

Common Use Cases

Immediately Lock a Compromised Account

When unauthorized access to an account is detected — via last, lastb, or an active connection in who — the immediate response is to lock the account with passwd -l. This prevents further authentication without deleting the account, which would destroy files and process ownership needed for forensics. Follow up by killing any active sessions with pkill -u username.

passwd -l compromised_user
pkill -u compromised_user
passwd -S compromised_user

Lock All Service Accounts to Prevent Interactive Login

Service accounts — www-data, nginx, mysql, redis, postgres, nobody — should never be used for interactive SSH login. Lock them as a baseline hardening step. An attacker who obtains these credentials cannot use them to SSH in if the accounts are locked.

for user in www-data nginx mysql redis postgres daemon bin sys; do
  passwd -l $user
  echo "Locked: $user"
done

Audit Password Status of All Human Accounts

Regular password status audits catch accounts with expired passwords (potential abandoned accounts), accounts with no password set (critical vulnerability), and accounts that have never had their password changed since creation. The passwd -S output for each account provides this information.

awk -F: '$3 >= 1000 {print $1}' /etc/passwd | while read user; do
  echo -n "$user: "; passwd -S "$user"
done

Security Relevance: Account Control as a Defense Layer

Practical Examples

Lock a compromised account and kill all its active sessions

passwd -l targetuser
who | grep targetuser
pkill -9 -u targetuser
passwd -S targetuser

Locks the account immediately, checks for active sessions, terminates all of them, and confirms the lock status. This four-command sequence is the standard immediate response to a suspected account compromise.

Find all accounts with no password set (critical security gap)

awk -F: '($2 == "" || $2 == "*" || $2 == "!") && $3 >= 1000' /etc/shadow

An empty password field in /etc/shadow means the account can potentially be accessed without a password depending on PAM configuration. The ‘!’ prefix indicates a locked account (safe). The ‘*’ indicates no password and no login capability (also safe for service accounts). An empty field is the dangerous case.

Force password expiry for all human accounts after a credential breach

awk -F: '$3 >= 1000 && $1 != "nobody" {print $1}' /etc/passwd | while read user; do
  passwd -e "$user"
  echo "Expired: $user"
done

Forces all human accounts to change their password at next login. Use this immediately after a suspected credential exposure — for example, after discovering that /etc/shadow was readable by a compromised service account.

Troubleshooting Common Issues

Summary

The passwd command is the primary tool for account lifecycle security on Linux: locking compromised accounts during incidents, hardening service accounts to prevent interactive login, and enforcing password policy for human users. Develop the habit of locking all service accounts as a baseline — their credentials are never needed interactively — and use passwd -l as the first response action when any account compromise is suspected.

• Lock all service accounts (www-data, nginx, mysql, etc.) as a baseline — they should never be used for interactive login
• passwd -l is the fastest incident response action for a compromised account — use it immediately, then kill active sessions
• Account locking does NOT block SSH key auth — pair it with usermod -s /usr/sbin/nologin for complete lockout