The searches «change Ubuntu password» and «reset Linux password» actually describe several different tasks: changing your own password, changing another user's password, setting its lifetime and regaining access when a password is lost. This article covers the passwd and chage commands, explains where the system stores passwords and shows how to set complexity requirements.
The root password and the sudo password are different things
The root password belongs to the root account. The sudo password is the password of your regular user: sudo asks for it to confirm that you are at the terminal and then performs the action as root. On Ubuntu the root account has no usable password by default: it is locked, and administration goes through sudo. So the answer to «what is the default root password on Ubuntu» is: there is none, password login as root is closed.
This is convenient and safer: every administrator action is tied to a specific user. There is no need to set a root password without a reason. For logging in to the server, use keys as described in the article SSH keys for a VDS.
passwd: change, lock, status
You change your own password with passwd and no arguments: the system asks for the current password and then the new one twice. An administrator changes another user's password. Locking does not delete the account, it only makes password login impossible:
passwd
sudo passwd alice
sudo passwd -l alice
sudo passwd -u alice
sudo passwd -S alice
sudo passwd -e alice- -l locks the user's password, -u removes the lock;
- -S shows the status: L means locked, P means a password is set, NP means no password;
- -e expires the password immediately, so the user must change it at the next login.
Locking the password does not close key-based SSH login. To disable an account completely, you must also restrict its keys.
chage: password lifetime
The chage utility manages password age. The chage -l command shows the current settings, the other options change them:
sudo chage -l alice
sudo chage -M 90 -W 7 alice
sudo chage -d 0 aliceHere -M sets the maximum password lifetime in days, -W sets how many days in advance to warn about the upcoming expiry, and -d 0 resets the date of the last change, so the user must set a new password at the next login. This is a convenient way to hand out a temporary password: you create the account, tell the user the initial password and require an immediate change. The minimum time between changes is set with -m, and -E sets the date on which the account gets locked.
Where passwords live: /etc/passwd and /etc/shadow
The /etc/passwd file is readable by everyone and describes users: seven colon-separated fields — name, the x character (the password is stored in another file), UID, GID, comment, home directory and shell. Password hashes are stored in /etc/shadow, whose access is restricted: ordinary users cannot read it. It has nine fields:
| Field | Meaning |
|---|---|
| 1 | User name |
| 2 | Password hash; a leading ! or * means locked |
| 3 | Date of the last password change, in days since 1970 |
| 4 | Minimum time between changes |
| 5 | Maximum password lifetime |
| 6 | How many days to warn in advance |
| 7 | How many days the account stays active after expiry |
| 8 | Date the account gets locked |
| 9 | Reserved |
The hash prefix indicates the algorithm: for example, $y$ is yescrypt, and older systems may use SHA-512. You do not need to edit these files by hand: passwd, chage and usermod exist for that. Reading shadow, however, is useful when diagnosing locks.
Complexity requirements: pam_pwquality
The pam_pwquality module checks a new password when it is changed through passwd. On Debian and Ubuntu it is installed by the libpam-pwquality package, and the rules live in /etc/security/pwquality.conf. On the RHEL family the same file is used by default.
sudo apt install libpam-pwquality
minlen = 12
minclass = 3
maxrepeat = 3
enforce_for_rootThe minlen parameter sets the minimum length, minclass sets the number of required character classes (lowercase, uppercase, digits, other), maxrepeat limits repetition of one character in a row, and enforce_for_root extends the rules to root as well. The policy applies only when a password is changed through PAM and does not protect against leaks: a good password must be unique. Selection advice is in the article secure passwords.
A lost password: what to do
If another user has sudo rights, they reset the password with sudo passwd name. If nobody has access, boot the server into rescue mode, attach the system disk and change the password inside a chroot. The procedure is described in the article server rescue mode.
Frequently asked questions
What is the default root password on Ubuntu?
None. On Ubuntu the root account is locked by default: the password field in /etc/shadow contains a lock marker, so you cannot log in as root with a password. Administration is done through sudo, which asks for the password of your regular user, the one you set when the server was created.
How do I change the password of an Ubuntu server?
Log in as your user and run passwd: enter the current password and then the new one twice. To change another user's password, use sudo passwd and the account name. If you log in with an SSH key, the password is needed only for sudo, and it is worth changing just as regularly.
How do I force a user to change the password at first login?
Run sudo chage -d 0 name or sudo passwd -e name. Both commands mark the password as expired, and at the next login the system demands a new password before any work begins. This is handy for issuing temporary passwords to new administrators or clients without giving them a permanent secret.
Can I find out a user's password from /etc/shadow?
No. The file holds not the password itself but its hash, which has no reverse transformation. A weak password can still be guessed by brute force if the file ends up with an outsider. That is why access to shadow is restricted and passwords should be long and unique. A forgotten password is not recovered, it is set again.