How to change user or root password in Linux (command guide)

On Linux, the root account is the one credential that makes every other control negotiable.

Anything holding it can read any file, change any configuration and remove its own traces, which is why it is the account attackers work toward rather than the one they start from. 

How exposed that account is tends to be underestimated. In March 2024, researchers found a deliberately planted backdoor in XZ Utils, a compression library that reaches into sshd via systemd links across several major distributions. Rated CVSS 10.0, it was built to break SSH authentication and grant remote access to the entire system. It was caught by a Microsoft engineer investigating a half-second delay in SSH logins. 

Password hygiene would not have stopped that issue

What it does is limit what an attacker can do with the credentials they obtain by more ordinary means, and knowing how to change and control Linux passwords is the floor on which the rest of privileged access control is built.

This guide will tell you how to do so using simple commands and tools. You'll benefit from the tips below if you're:

• a regular user wanting to update their password.
• an administrator managing multiple users in a Linux environment.
• someone trying to reset a forgotten root password.

You'll also learn some best practices for securing your Linux system.

Password management is similar across Linux distributions, so system administrators, developers and regular users can all benefit from this guide.

Tools and commands for changing passwords

You can change passwords with Linux's command-line interface, also known as the terminal.

The most common command is:

passwd

You can use this command to change your own password as well as other users' passwords for both standard and root accounts.

To change your password, simply run "passwd" with Linux's command-line interface.

To change other users' passwords, run the command with superuser privileges by adding "sudo" before "passwd" and then input the username of the person whose password you want to change. Your command should look like this:

sudo passwd

Other commands you might want to use include:

• chpasswd. Great for changing multiple passwords simultaneously.
• usermod. Helps you lock or unlock user accounts.
• chage. Used for managing password expiration policies.

How to change your own password

Changing your password on Linux involves using the "passwd" command and setting your password policies. This process is as follows.

1. Using the 'passwd' command

Here's how to change your password in Linux with the "passwd" command:

• Open the command-line interface.
• Type "passwd" and press "Enter."
• Enter your current password when prompted.
• Enter your new password and confirm it.

Here's an example of the command:

$ passwd

Changing password for user.

Current password: [Enter current password]

New password: [Enter new password]

Retype new password: [Confirm new password]

If your password doesn't meet your security policies, you'll receive an error and will have to try again. 

2. Setting password policies

Passwords built from a birthday, a pet's name or a team are the ones dictionary and hybrid attacks are designed to find, because the attacker can assemble that list from a social media profile before trying anything. Two controls help:

1. To strengthen passwords, administrators can enforce password complexity rules using the "pam_pwquality" module, which is a pluggable authentication module. Where your distribution supports it, screening new passwords against a known-breached list catches more than the character-class rules do, because length and unpredictability matter more than symbol count. 
2. To change your password expiration policy, use the "chage" command. For example, you can require users to change their passwords every six months.

How to change another user's password

Changing another person's password depends on whether you're a root user or a system administrator.

1. As a root user

You can change other users' passwords with the "passwd" command if you're a root user. Follow these steps:

• Open the terminal.
• Use this command: sudo passwd .
• Enter your own password to confirm root access.
• Enter and confirm the new password for the user.

For example:

$ sudo passwd john

Enter new UNIX password: [Enter new password for user]

Retype new UNIX password: [Confirm password]

2. As a system administrator

The "chpasswd" command lets you batch-change other users' passwords or automate user management as a system administrator.

Here's an example of scripting "chpasswd" for multiple users:

$chpasswd

user1:user1_password

user2:user2_password

user3:user3_password

Chpasswd reads them in clear text, so piping them from a file or a heredoc puts them on a disk and typing them interactively puts them in your shell history. For anything beyond a one-off, read the values from a vault at runtime and do not leave the file behind.

Resetting forgotten passwords in Linux

Thankfully, you can quickly reset forgotten passwords on Linux, whether you're a standard user or a root user.

1. For standard users

If you've forgotten your password but have root access, simply use the "passwd" command to reset it:

sudo passwd

Then, follow the prompts to set a new password.

2. For root users

If you don't know the root password, follow these steps:

• Restart your system and boot into recovery mode (GRUB menu).
• Drop to the root shell prompt.
• Use the passwd command to set a new password for root.
• Reboot the system after resetting.

This method helps you regain access without having to reinstall Linux.

Advanced password management

Here are some tips for more advanced password management in Linux.

1. Password expiration and history policies

Linux lets administrators enforce password expiration policies with the "chage" command. To check a user's expiration status, use this command:

sudo chage -l

To force a user to change their password at the next log-in, use this command:

sudo chage -d 0

This is the right tool when you have a reason to force a change, such as evidence that a credential was exposed or an administrator handing over an account. Whether to run it on a fixed calendar is a separate question, and a contested one. There are pros and cons of frequent password rotation on both sides. 

2. Locking and unlocking user accounts

The "usermod" command temporarily prevents a user from logging in.

• To lock an account, run the following: sudo usermod -L .
• To unlock an account, run the following: sudo usermod -U .

These commands are useful if you suspect someone has compromised an account or you need to revoke a user's access to your system.

Beyond changing the password

Linux lets you improve your password management by running different commands and tools. That way, you can update your credentials, reset forgotten details, and control system access. By requiring complex passwords and keeping your system up to date, you can make your Linux environment more secure.

Now, you can take your security to the next level with Delinea. Our Zero Trust Privileged Access Management platform helps you improve your authentication process, monitor activity, streamline access management, and ensure the secure management of root credentials. As a result, you can rest easy knowing that only authorized persons have access to your Linux system.

Book a demo today.

Protect servers in hybrid cloud environments

Reduce risk by limiting standing privileges and preventing lateral movement.

TAKE A CLOSER LOOK