passwd tips — authorized password-change literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may change the target account password (lab VM / syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any write — never rotate production passwords without change control.
3. Record short factual notes; quote short Evidence (account name redacted, success/fail, aging follow-up — never the password itself).
4. Optional: batch updates → chpasswd-tips.
5. Optional: aging → chage-tips.
6. Optional: lockout recovery on lab → faillock-tips.
7. Never paste plaintext passwords into binders, tickets, or screenshots.
8. Stop at literacy — no exploit / unauthorized password-reset cookbooks.

Allowed framing

• Classroom labs rotating disposable lab-user passwords on authorized hosts.
• Binding short factual notes as Evidence (status only — no secrets).
• Documenting expected vs observed password policy messages for authorized inventory notes.
• Comparing passwd ↔ chpasswd / chage / faillock peer tip pages under one binder.
• Locking/unlocking lab-only accounts (-l / -u) when the syllabus authorizes that drill.

Scope we will not cover

• No crack/pirate/keygen via passwd.
• No intentional account-takeover PoCs against foreign users.
• No credential-theft or password dumping against hosts you do not own.
• No bypass cookbooks that clear passwords / disable authentication without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved lab host and a disposable lab user you may administer.
2. Change that lab user's password interactively with passwd; quote success only (no secret).
3. Optional: passwd -S <labuser> status line as Evidence (redact name if required).
4. Optional: set aging with chage-tips; integrity with pwck-tips.
5. Stop at literacy — no attack or unauthorized password-reset cookbooks.

Practical notes for authorized labs

• -S status is binder-friendly; avoid dumping /etc/shadow lines into notes.
• -l / -u lock and unlock — label lab locks clearly so they are not mistaken for production incidents.
• -e force expire belongs in policy drills with written approval.
• Pair with chpasswd-tips when the syllabus asks for batch stdin updates instead of interactive prompts.
• After repeated fails, consult faillock-tips before assuming the password is wrong.
• Never commit password lists to git — even for labs; use ephemeral files with restrictive modes.

FAQ-aligned refusals (quick)

• Foreign account password resets → refuse.
• Sharing plaintext lab passwords in public binders → refuse.
• Shadow-hash cracking cookbooks → refuse.

For legal, authorized and educational use only.

FAQ

Sources