Chris Hofstaedtler
372 lines
12 KiB
Groff
372 lines
12 KiB
Groff
'\" t
|
|
.\" Title: passwd
|
|
.\" Author: Julianne Frances Haugh
|
|
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
|
.\" Date: 01.02.2026
|
|
.\" Manual: User Commands
|
|
.\" Source: shadow-utils 4.19.3
|
|
.\" Language: German
|
|
.\"
|
|
.TH "PASSWD" "1" "01.02.2026" "shadow\-utils 4\&.19\&.3" "User Commands"
|
|
.\" -----------------------------------------------------------------
|
|
.\" * Define some portability stuff
|
|
.\" -----------------------------------------------------------------
|
|
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
.\" http://bugs.debian.org/507673
|
|
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
|
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
.ie \n(.g .ds Aq \(aq
|
|
.el .ds Aq '
|
|
.\" -----------------------------------------------------------------
|
|
.\" * set default formatting
|
|
.\" -----------------------------------------------------------------
|
|
.\" disable hyphenation
|
|
.nh
|
|
.\" disable justification (adjust text to left margin only)
|
|
.ad l
|
|
.\" -----------------------------------------------------------------
|
|
.\" * MAIN CONTENT STARTS HERE *
|
|
.\" -----------------------------------------------------------------
|
|
.SH "NAME"
|
|
passwd \- \(:andert das Passwort eines Benutzers
|
|
.SH "\(:UBERSICHT"
|
|
.HP \w'\fBpasswd\fR\ 'u
|
|
\fBpasswd\fR [\fIoptions\fR] [\fILOGIN\fR]
|
|
.SH "BESCHREIBUNG"
|
|
.PP
|
|
The
|
|
\fBpasswd\fR
|
|
command changes passwords for user accounts\&. A regular user can only change the password for their own account, while the superuser can change the password for any account\&. The
|
|
\fBpasswd\fR
|
|
also changes the account or associated password validity period\&.
|
|
.SS "Ver\(:andern des Passworts"
|
|
.PP
|
|
If the account has a non\-empty password, the user is first prompted to enter their current password\&. The entered password is encrypted and compared to the stored value\&. The user has only one attempt to enter the correct password\&. The superuser can bypass this step to allow changing forgotten passwords\&.
|
|
.PP
|
|
After the password has been entered, password aging information is checked to determine if the user is permitted to change the password at this time\&. If not,
|
|
\fBpasswd\fR
|
|
refuses to change the password and exits\&.
|
|
.PP
|
|
The user is then prompted twice for a replacement password\&. The second entry is compared against the first and both are required to match for the password to be changed\&.
|
|
.PP
|
|
Then, the password is tested for complexity\&.
|
|
\fBpasswd\fR
|
|
rejects passwords that do not meet the complexity requirements\&. Do not include the system default erase or kill characters\&.
|
|
.SS "Hinweise zu Benutzerpassw\(:ortern"
|
|
.PP
|
|
The security of a password depends on the strength of the encryption algorithm and the size of the key space\&. The legacy
|
|
\fIUNIX\fR
|
|
System encryption method is based on the NBS DES algorithm\&. More recent methods are now recommended (see
|
|
\fBENCRYPT_METHOD\fR)\&. The size of the key space depends on the randomness of the selected password\&.
|
|
.PP
|
|
Compromises in password security normally result from careless password selection or handling\&. For this reason, you should not select a password which appears in a dictionary or one that must be written down\&. The password should also not be a proper name, your license number, birth date, or street address\&. Any of these may be used as guesses to violate system security\&.
|
|
.PP
|
|
As a general guideline, passwords should be long and random\&. It\*(Aqs fine to use simple character sets, such as passwords consisting only of lowercase letters, if that helps memorizing longer passwords\&. For a password consisting only of lowercase English letters randomly chosen, and a length of 32, there are 26^32 (approximately 2^150) different possible combinations\&. Being an exponential equation, it\*(Aqs apparent that the exponent (the length) is more important than the base (the size of the character set)\&.
|
|
.PP
|
|
You can find advice on how to choose a strong password on https://en\&.wikipedia\&.org/wiki/Password_strength
|
|
.SH "OPTIONEN"
|
|
.PP
|
|
The options which apply to the
|
|
\fBpasswd\fR
|
|
command are:
|
|
.PP
|
|
\fB\-a\fR, \fB\-\-all\fR
|
|
.RS 4
|
|
This option can be used only with
|
|
\fB\-S\fR
|
|
and causes show status for all users\&.
|
|
.RE
|
|
.PP
|
|
\fB\-d\fR, \fB\-\-delete\fR
|
|
.RS 4
|
|
Deletes a user\*(Aqs password, making it empty\&. This command sets the account to be passwordless\&.
|
|
.RE
|
|
.PP
|
|
\fB\-e\fR, \fB\-\-expire\fR
|
|
.RS 4
|
|
macht dem Passwort sofort ung\(:ultig\&. Damit ist der Benutzer gezwungen, das Passwort bei der n\(:achsten Anmeldung zu \(:andern\&.
|
|
.RE
|
|
.PP
|
|
\fB\-h\fR, \fB\-\-help\fR
|
|
.RS 4
|
|
zeigt die Hilfe an und beendet das Programm\&.
|
|
.RE
|
|
.PP
|
|
\fB\-i\fR, \fB\-\-inactive\fR\ \&\fIINACTIVE\fR
|
|
.RS 4
|
|
This option is used to disable an account after the password has been expired for a number of days\&. After a user account has had an expired password for
|
|
\fIINACTIVE\fR
|
|
days, the user may no longer sign on to the account\&.
|
|
.RE
|
|
.PP
|
|
\fB\-k\fR, \fB\-\-keep\-tokens\fR
|
|
.RS 4
|
|
gibt an, dass nur abgelaufene Passw\(:orter ge\(:andert werden sollen und der Benutzer ein g\(:ultiges behalten will\&.
|
|
.RE
|
|
.PP
|
|
\fB\-l\fR, \fB\-\-lock\fR
|
|
.RS 4
|
|
sperrt das Passwort des bezeichneten Kontos\&. Die Option schaltet ein Passwort ab, indem es ihm einen Wert zuweist, der mit keinem m\(:oglichen verschl\(:usselten Wert \(:ubereinstimmen kann\&. Dies geschieht, indem ein \(Fc!\(Fo dem Passwort vorangestellt wird\&.
|
|
.sp
|
|
Note that this does not disable the account\&. The user may still be able to login using another authentication token (e\&.g\&. an SSH key)\&. To disable the account, administrators should use
|
|
\fBusermod \-\-expiredate 1\fR
|
|
(this sets the account\*(Aqs expire date to 1970\-01\-02)\&.
|
|
.sp
|
|
Benutzer mit einem gesperrten Passwort k\(:onnen dieses nicht \(:andern\&.
|
|
.RE
|
|
.PP
|
|
\fB\-n\fR, \fB\-\-mindays\fR\ \&\fIMIN_DAYS\fR
|
|
.RS 4
|
|
Set the minimum number of days between password changes to
|
|
\fIMIN_DAYS\fR\&. A value of zero for this field indicates that the user may change their password at any time\&.
|
|
.RE
|
|
.PP
|
|
\fB\-q\fR, \fB\-\-quiet\fR
|
|
.RS 4
|
|
stiller Modus
|
|
.RE
|
|
.PP
|
|
\fB\-r\fR, \fB\-\-repository\fR\ \&\fIREPOSITORY\fR
|
|
.RS 4
|
|
change password in
|
|
\fIREPOSITORY\fR
|
|
repository
|
|
.RE
|
|
.PP
|
|
\fB\-R\fR, \fB\-\-root\fR\ \&\fICHROOT_DIR\fR
|
|
.RS 4
|
|
Apply changes in the
|
|
\fICHROOT_DIR\fR
|
|
directory and use the configuration files from the
|
|
\fICHROOT_DIR\fR
|
|
directory\&. Only absolute paths are supported\&. No SELINUX support\&.
|
|
.RE
|
|
.PP
|
|
\fB\-P\fR, \fB\-\-prefix\fR\ \&\fIPREFIX_DIR\fR
|
|
.RS 4
|
|
Apply changes to configuration files under the root filesystem found under the directory
|
|
\fIPREFIX_DIR\fR\&. This option does not chroot and is intended for preparing a cross\-compilation target\&. Some limitations: NIS and LDAP users/groups are not verified\&. No PAM support\&. No SELINUX support\&.
|
|
.RE
|
|
.PP
|
|
\fB\-S\fR, \fB\-\-status\fR
|
|
.RS 4
|
|
zeigt den Status des Kontos an\&. Er setzt sich aus Informationen in sieben Feldern zusammen\&. Das erste Feld ist der Anmeldename des Benutzers\&. Das zweite Feld zeigt an, ob das Benutzerkonto ein gesperrtes Passwort (L), kein Passwort (NP) oder ein verwendbares Passwort hat (P)\&. Das dritte Feld zeigt das Datum der letzten \(:Anderung des Passworts an\&. Die n\(:achsten vier Felder sind die Mindest\- und H\(:ochstzeit f\(:ur seine Verwendung, die Vorwarnzeit und die Karenzzeit in Zusammenhang mit seinem Ablauf\&. Diese Zeiten werden in Tagen ausgedr\(:uckt\&.
|
|
.RE
|
|
.PP
|
|
\fB\-u\fR, \fB\-\-unlock\fR
|
|
.RS 4
|
|
Unlock the password of the named account\&. This option re\-enables a password by changing the password back to its previous value (to the value before using the
|
|
\fB\-l\fR
|
|
option)\&.
|
|
.RE
|
|
.PP
|
|
\fB\-w\fR, \fB\-\-warndays\fR\ \&\fIWARN_DAYS\fR
|
|
.RS 4
|
|
Set the number of days of warning before a password change is required\&. The
|
|
\fIWARN_DAYS\fR
|
|
option is the number of days prior to password expiration during which the user is warned that their password is about to expire\&.
|
|
.RE
|
|
.PP
|
|
\fB\-x\fR, \fB\-\-maxdays\fR\ \&\fIMAX_DAYS\fR
|
|
.RS 4
|
|
Set the maximum number of days a password remains valid\&. After
|
|
\fIMAX_DAYS\fR, the password is required to be changed\&.
|
|
.sp
|
|
Passing the number
|
|
\fI\-1\fR
|
|
as
|
|
\fIMAX_DAYS\fR
|
|
will remove checking a password\*(Aqs validity\&.
|
|
.RE
|
|
.PP
|
|
\fB\-s\fR, \fB\-\-stdin\fR
|
|
.RS 4
|
|
This option is used to indicate that passwd should read the new password from standard input, which can be a pipe\&.
|
|
.RE
|
|
.SH "WARNUNGEN"
|
|
.PP
|
|
Die Pr\(:ufung des Passwortes auf Komplexit\(:at kann je nach System verschieden sein\&. Benutzer und Benutzerinnen werden angehalten, ein komplexes aber noch angenehmes Passwort zu w\(:ahlen\&.
|
|
.PP
|
|
Benutzer k\(:onnen unter Umst\(:anden ihr Passwort nicht \(:andern, wenn auf dem System NIS aktiviert ist, sie aber nicht am NIS\-Server angemeldet sind\&.
|
|
.SH "KONFIGURATION"
|
|
.PP
|
|
The following configuration variables in
|
|
/etc/login\&.defs
|
|
change the behavior of this tool:
|
|
.PP
|
|
\fBENCRYPT_METHOD\fR (string)
|
|
.RS 4
|
|
This defines the system default encryption algorithm for encrypting passwords (if no algorithm is specified on the command line)\&.
|
|
.sp
|
|
It can take one of these values:
|
|
\fIDES\fR
|
|
(default),
|
|
\fIMD5\fR, \fISHA256\fR, \fISHA512\fR\&. MD5 and DES should not be used for new hashes, see
|
|
crypt(5)
|
|
for recommendations\&.
|
|
.sp
|
|
Note: this parameter overrides the
|
|
\fBMD5_CRYPT_ENAB\fR
|
|
variable\&.
|
|
.RE
|
|
.PP
|
|
\fBMD5_CRYPT_ENAB\fR (boolean)
|
|
.RS 4
|
|
Indicate if passwords must be encrypted using the MD5\-based algorithm\&. If set to
|
|
\fIyes\fR, new passwords will be encrypted using the MD5\-based algorithm compatible with the one used by recent releases of FreeBSD\&. It supports passwords of unlimited length and longer salt strings\&. Set to
|
|
\fIno\fR
|
|
if you need to copy encrypted passwords to other systems which don\*(Aqt understand the new algorithm\&. Default is
|
|
\fIno\fR\&.
|
|
.sp
|
|
This variable is superseded by the
|
|
\fBENCRYPT_METHOD\fR
|
|
variable or by any command line option used to configure the encryption algorithm\&.
|
|
.sp
|
|
This variable is deprecated\&. You should use
|
|
\fBENCRYPT_METHOD\fR\&.
|
|
.RE
|
|
.PP
|
|
\fBOBSCURE_CHECKS_ENAB\fR (boolean)
|
|
.RS 4
|
|
Enable additional checks upon password changes\&.
|
|
.RE
|
|
.PP
|
|
\fBPASS_ALWAYS_WARN\fR (boolean)
|
|
.RS 4
|
|
Warn about weak passwords (but still allow them) if you are root\&.
|
|
.RE
|
|
.PP
|
|
\fBPASS_CHANGE_TRIES\fR (number)
|
|
.RS 4
|
|
Maximum number of attempts to change password if rejected (too easy)\&.
|
|
.RE
|
|
.PP
|
|
\fBPASS_MAX_LEN\fR (number), \fBPASS_MIN_LEN\fR (number)
|
|
.RS 4
|
|
Number of significant characters in the password for crypt()\&.
|
|
.sp
|
|
\fBPASS_MAX_LEN\fR
|
|
is 8 by default\&. Don\*(Aqt change unless your crypt() is better\&.
|
|
.sp
|
|
\fBPASS_MAX_LEN\fR
|
|
is only used for DES\&. It is ignored if an encryption algorithm other than DES is used, either because
|
|
\fBMD5_CRYPT_ENAB\fR
|
|
set to
|
|
\fIyes\fR
|
|
or
|
|
\fBENCRYPT_METHOD\fR
|
|
set to an algorithm other than
|
|
\fIDES\fR\&.
|
|
.sp
|
|
In addition,
|
|
\fBPASS_MAX_LEN\fR
|
|
is only used if
|
|
\fBOBSCURE_CHECKS_ENAB\fR
|
|
set to
|
|
\fIyes\fR\&.
|
|
.sp
|
|
Note: This only affects the generation of user passwords\&. Group password lengths are not checked\&.
|
|
.RE
|
|
.PP
|
|
\fBSHA_CRYPT_MIN_ROUNDS\fR (number), \fBSHA_CRYPT_MAX_ROUNDS\fR (number)
|
|
.RS 4
|
|
When
|
|
\fBENCRYPT_METHOD\fR
|
|
is set to
|
|
\fISHA256\fR
|
|
or
|
|
\fISHA512\fR, this defines the number of SHA rounds used by the encryption algorithm by default (when the number of rounds is not specified on the command line)\&.
|
|
.sp
|
|
With a lot of rounds, it is more difficult to brute force the password\&. But note also that more CPU resources will be needed to authenticate users\&.
|
|
.sp
|
|
If not specified, the libc will choose the default number of rounds (5000), which is orders of magnitude too low for modern hardware\&.
|
|
.sp
|
|
The values must be inside the 1000\-999,999,999 range\&.
|
|
.sp
|
|
If only one of the
|
|
\fBSHA_CRYPT_MIN_ROUNDS\fR
|
|
or
|
|
\fBSHA_CRYPT_MAX_ROUNDS\fR
|
|
values is set, then this value will be used\&.
|
|
.sp
|
|
If
|
|
\fBSHA_CRYPT_MIN_ROUNDS\fR
|
|
>
|
|
\fBSHA_CRYPT_MAX_ROUNDS\fR, the highest value will be used\&.
|
|
.RE
|
|
.SH "DATEIEN"
|
|
.PP
|
|
/etc/passwd
|
|
.RS 4
|
|
Informationen zu den Benutzerkonten
|
|
.RE
|
|
.PP
|
|
/etc/shadow
|
|
.RS 4
|
|
gesch\(:utzte Informationen zu den Benutzerkonten
|
|
.RE
|
|
.PP
|
|
/etc/login\&.defs
|
|
.RS 4
|
|
konfiguriert die Shadow\-Hilfsprogramme\&.
|
|
.RE
|
|
.SH "R\(:UCKGABEWERTE"
|
|
.PP
|
|
The
|
|
\fBpasswd\fR
|
|
command exits with the following values:
|
|
.PP
|
|
\fI0\fR
|
|
.RS 4
|
|
success
|
|
.RE
|
|
.PP
|
|
\fI1\fR
|
|
.RS 4
|
|
permission denied
|
|
.RE
|
|
.PP
|
|
\fI2\fR
|
|
.RS 4
|
|
invalid combination of options
|
|
.RE
|
|
.PP
|
|
\fI3\fR
|
|
.RS 4
|
|
unexpected failure, nothing done
|
|
.RE
|
|
.PP
|
|
\fI4\fR
|
|
.RS 4
|
|
unexpected failure,
|
|
passwd
|
|
file missing
|
|
.RE
|
|
.PP
|
|
\fI5\fR
|
|
.RS 4
|
|
passwd
|
|
file busy, try again
|
|
.RE
|
|
.PP
|
|
\fI6\fR
|
|
.RS 4
|
|
invalid argument to option
|
|
.RE
|
|
.PP
|
|
\fI10\fR
|
|
.RS 4
|
|
an error was returned by
|
|
pam(3)
|
|
.RE
|
|
.SH "SIEHE AUCH"
|
|
.PP
|
|
\fBchpasswd\fR(8),
|
|
\fBmakepasswd\fR(1),
|
|
\fBpasswd\fR(5),
|
|
\fBshadow\fR(5),
|
|
\fBlogin.defs\fR(5),
|
|
\fBusermod\fR(8)\&.
|
|
.PP
|
|
The following web page comically (yet correctly) compares the strength of two different methods for choosing a password: "https://xkcd\&.com/936/"
|