chpasswd tips — authorized batch-password literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may batch-update passwords on the host (lab VM / syllabus box you own or were given access to).
2. Prefer a small lab batch (2–3 disposable users) — never pipe production password lists without change control.
3. Record short factual notes; quote short Evidence (count of accounts updated, encrypt method flag — never the user:password lines).
4. Use ephemeral files with mode 0600; shred or unlink after the drill.
5. Optional: interactive alternative → passwd-tips.
6. Optional: create-then-set via newusers-tips when accounts do not exist yet.
7. Optional: aging follow-up → chage-tips.
8. Stop at literacy — no exploit / unauthorized mass-reset cookbooks.

Allowed framing

• Classroom labs batch-updating disposable lab-user passwords on authorized hosts.
• Binding short factual notes as Evidence (batch size, method flags — no secrets).
• Documenting expected vs observed encrypt options (-e, -m, -c) for authorized inventory notes.
• Comparing chpasswd ↔ passwd / newusers peer tip pages under one binder.
• Practicing safe stdin hygiene when the syllabus authorizes batch drills.

Scope we will not cover

• No crack/pirate/keygen via chpasswd.
• No intentional mass-takeover PoCs against foreign accounts.
• No credential-theft or password-list sharing against hosts you do not own.
• No bypass cookbooks that install known passwords on privileged accounts without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved lab host with 2–3 disposable lab users.
2. Prepare an ephemeral user:password list (mode 0600); do not commit it.
3. Pipe into chpasswd under authorization; quote success count only.
4. Unlink/shred the input file; optional aging via chage-tips.
5. Stop at literacy — no attack or unauthorized mass-reset cookbooks.

Practical notes for authorized labs

• Default expects plaintext user:password lines on stdin — treat the pipe as a secret channel.
• -e expects pre-encrypted hashes; still redact — hashes are sensitive Evidence.
• -c / method flags vary by distro build — quote the flag you used, not a universal recipe.
• Prefer newusers-tips when you must create accounts and set passwords in one batch file format.
• Never leave password batch files in /tmp world-readable.
• Pair with pwck-tips if shadow integrity looks wrong after a lab batch.

FAQ-aligned refusals (quick)

• Foreign host mass password resets → refuse.
• Publishing user:password lab files → refuse.
• Using chpasswd to plant shared backdoor passwords → refuse.

For legal, authorized and educational use only.

FAQ

Sources