Set Linux Account Expiration Dates with chage, useradd and usermod

This article is a localized edition of the Japanese original. Read the Japanese original

Accounts for temporary workers and contractors tend to be forgotten and left behind after the job is done. On Linux, if you give an account an expiration date, it can no longer log in from that date on. This article explains how to set, check and remove an account expiration date with standard commands such as chage, and how it differs from the easily confused "password expiration."

The commands are those of shadow-utils (the standard on many distributions). Setting them requires root privileges, so run them with sudo.

Account expiration vs. password expiration

If you want the account to stop working after a date, use account expiration; if you want users to change their passwords regularly, use password expiration.

Check the current settings

sudo chage -l user1

The output means the following.

Add an expiration date to an existing account

Pass a date in YYYY-MM-DD form to chage -E.

sudo chage -E 2026-12-31 user1
sudo chage -l user1

If Account expires shows the date you specified, it is set. Internally it is stored as the number of days since January 1, 1970 in the eighth field of /etc/shadow, and from that day on (days are counted in UTC) the account can no longer log in. If you want the user to be able to work through the whole of December 31, it is safer to specify the next day, 2027-01-01.

usermod -e sets the same value.

sudo usermod -e 2026-12-31 user1

Set an expiration date at creation

With useradd -e, you can set the date at the same time as creating the account.

sudo useradd -m -e 2026-12-31 user2
sudo passwd user2

To give every newly created account an expiration date, change the useradd default (the setting is saved as EXPIRE in /etc/default/useradd).

sudo useradd -D -e 2026-12-31
sudo useradd -D

If you create accounts with the adduser command on Debian / Ubuntu, also check with chage -l after creation that the expiration date is set.

Remove or extend the expiration date

To remove the date, specify -1.

sudo chage -E -1 user1

Account expires goes back to never. To extend it, run chage -E again with the new date.

Set password expiration

If you want users to change their passwords regularly, set it as follows.

# Valid for 90 days, no change again for 1 day after changing, warn 7 days before expiry
sudo chage -M 90 -m 1 -W 7 user1

# Lock the account 14 days after the password expires
sudo chage -I 14 user1

passwd -x 90 user1, like chage -M 90 user1, sets how many days the password is valid. It is not the account expiration date.

What /etc/login.defs affects

PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE in /etc/login.defs are defaults used when an account is created. Changing them does not affect existing accounts. Set existing accounts individually with chage.

PASS_MAX_DAYS   90
PASS_MIN_DAYS   1
PASS_WARN_AGE   7

List accounts that have an expiration date

This shows accounts with a value in the eighth field of /etc/shadow and converts the day count to a date.

sudo awk -F: '$8 != "" { print $1, $8 }' /etc/shadow | while read -r name days; do
  echo "$name $(date -u -d "@$((days * 86400))" +%F)"
done

Do not edit /etc/shadow directly with an editor. If you break its format, nobody may be able to log in. Make changes with chage, usermod and passwd.

What happens when an account expires

• Logins with a password and with an SSH public key are both refused (with the default OpenSSH setup)
• Sessions that are already logged in at the time of expiry are not disconnected automatically
• Services that check the account status through PAM (such as cron) may no longer run as that user

The logs contain entries such as account has expired (/var/log/auth.log on Debian / Ubuntu, /var/log/secure on RHEL-based systems; on systemd systems you can also check with journalctl).

How to lock and unlock an account immediately is covered in How to lock and unlock Linux accounts.

Summary

• Set an account expiration date with chage -E YYYY-MM-DD username and remove it with chage -E -1
• You can also set it with useradd -e at creation or usermod -e for existing accounts
• It is separate from password expiration (chage -M, passwd -x)
• The values in /etc/login.defs only apply to newly created accounts
• Check with chage -l, make changes with commands, and do not edit /etc/shadow directly

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)