CODEWITHSUNDEEP
linuxpasswords
prashanth cm
prashanth cm

Reputation: 49

Error : You are required to change your password immediately (root enforced)

I'm trying to add a new use to a linux machine. I used this command.

adduser "user_name" -u "UID" -G "GROUP_NAME"

the entry what is see in /etc/shadow is 

"user_name":$1$IfBL9BXC$ealgUJum3HJsDRqOUY74O1:0:0:99999::::

But when I try to login with the same user name,my password was accepted but immediately asked me to change password as below.

You are required to change your password immediately (root enforced)

What should I do?

Upvotes: 2

Views: 21365

Answers (3)

Lucas Basquerotto
Lucas Basquerotto

Reputation: 8083

In my case I wanted to install MySQL 8.0 non-interactively in the User Data specified when creating the droplet instance, and it showed the error You are required to change your password immediately (root enforced).

My solution is based on the answer of unilynx, but without needing Ansible (because the user data is run before ansible runs the tasks in the host):

sed -i 's/^root:.*$/root:*:16231:0:99999:7:::/' /etc/shadow

This way the root account is disabled for login, but I don't receive the error I mentioned above.

Upvotes: 1

unilynx
unilynx

Reputation: 486

For anyone who comes across this when dealing with eg. DigitalOcean machines which are set up this way, and don't feel like manually fixing this because they automate deployments anyway and only use publickey authentication, here's an Ansible task to fix this:

# http://docs.ansible.com/ansible/lineinfile_module.html
# Get rid of DO's root password and 'you must change next time you login' stuff
- name: Setup root account properly
  lineinfile:
    backup: yes
    dest: /etc/shadow
    regexp: "^root:.*$"
    state: present
    line: "root:*:16231:0:99999:7:::"

Upvotes: 8

Marcelo Cerri
Marcelo Cerri

Reputation: 162

The best thing to do is to change your password as asked.

The third field in the /etc/shadow file indicates the number of days (since January 1, 1970) since the password was last changed. An empty values indicates the password was never changed and a value of 0 forces the user to change it.

As an alternative, you can edit your /etc/shadow file and remove the 0 from the third field. But do that at your own risk.

Upvotes: 1

Related Questions