DEV Community

Janak Shrestha
Janak Shrestha

Posted on

Temporary User Setup with Expiry

#linux

As part of the temporary assignment to the Nautilus project, a developer named mark requires access for a limited duration. To ensure smooth access management, a temporary user account with an expiry date is needed. Here's what you need to do:

Create a user named mark on App Server 3 in Stratos Datacenter. Set the expiry date to 2027-04-15, ensuring the user is created in lowercase as per standard protocol.

Solution

Step 1: Connect to App Server 3 (stapp03)

From the jump host or directly:

ssh banner@stapp03
# Password: BigGr33n
Enter fullscreen mode Exit fullscreen mode

Step 2: Switch to root or use sudo 

sudo su -
# Password: BigGr33n
Enter fullscreen mode Exit fullscreen mode

Step 3: Create user with expiry date

Use the useradd command with the -e option to set the expiry date:

useradd -e 2027-04-15 mark
Enter fullscreen mode Exit fullscreen mode

Command breakdown:

  • -e 2027-04-15: Sets the account expiry date to April 15, 2027
  • mark: The username (in lowercase as required)

Date format: YYYY-MM-DD

Step 4: Verify the user creation and expiry 

# Check user exists
id mark

# Check user details including expiry
chage -l mark

# Check expiry date in /etc/shadow
grep mark /etc/shadow

# Verify username is lowercase
echo "mark" | grep -q "^[a-z]*$" && echo "✓ Username is lowercase" || echo "✗ Username is not lowercase"
Enter fullscreen mode Exit fullscreen mode

Complete One-Line Commands

From jump host (with password): 

echo 'BigGr33n' | ssh banner@stapp03 "sudo -S useradd -e 2027-04-15 mark 2>/dev/null && echo 'User mark created successfully with expiry date 2027-04-15' || echo 'User mark already exists'; sudo -S id mark; sudo -S chage -l mark"
Enter fullscreen mode Exit fullscreen mode

From jump host using heredoc: 

ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
useradd -e 2027-04-15 mark 2>/dev/null && echo "✓ User mark created successfully with expiry date 2027-04-15" || echo "✓ User mark already exists"
echo "Verification:"
id mark
echo ""
echo "Account expiry information:"
chage -l mark
'
EOF
Enter fullscreen mode Exit fullscreen mode

Step-by-Step Interactive Commands 

# Connect to stapp03
ssh banner@stapp03
# Enter password: BigGr33n

# Become root
sudo su -
# Enter password: BigGr33n

# Create user with expiry date
useradd -e 2027-04-15 mark

# Verify user creation
id mark
# Expected: uid=1002(mark) gid=1002(mark) groups=1002(mark)

# Check expiry details
chage -l mark

# Expected output shows:
# Last password change                                    : [current_date]
# Password expires                                        : never
# Password inactive                                       : never
# Account expires                                         : Apr 15, 2027
# Minimum number of days between password change          : 0
# Maximum number of days between password change          : 99999
# Number of days of warning before password expires       : 7

# Check /etc/shadow entry
grep mark /etc/shadow
# The expiry date is stored as days since 1970-01-01 in the 8th field

# Exit back
exit
exit
Enter fullscreen mode Exit fullscreen mode

Additional Options

Create user with specific home directory and expiry: 

useradd -e 2027-04-15 -d /home/mark -m mark
Enter fullscreen mode Exit fullscreen mode

Create user with specific shell and expiry: 

useradd -e 2027-04-15 -s /bin/bash mark
Enter fullscreen mode Exit fullscreen mode

Create user with specific UID and expiry: 

useradd -e 2027-04-15 -u 1625 mark
Enter fullscreen mode Exit fullscreen mode

Create user with no home directory and expiry: 

useradd -e 2027-04-15 -M mark
Enter fullscreen mode Exit fullscreen mode

Verification Commands

Run these to confirm everything is correct:

# Check user exists
id mark

# Check account expiry
chage -l mark | grep "Account expires"

# Check expiry in /etc/shadow (field 8)
grep mark /etc/shadow | awk -F: '{print "Expiry days since 1970-01-01:", $8}'

# Check username format (lowercase)
echo "mark" | grep -q "^[a-z]*$" && echo "✓ Username is lowercase" || echo "✗ Username is not lowercase"

# Check when account will expire
date -d "2027-04-15" +"%A, %B %d, %Y"

# Verify account status
passwd -S mark
Enter fullscreen mode Exit fullscreen mode

Understanding the Expiry Mechanism

How it works:

  1. The expiry date is stored in /etc/shadow as days since 1970-01-01
  2. When the date passes, the account becomes locked
  3. The user will not be able to login after the expiry date

Check expiry in /etc/shadow: 

# View the shadow entry
grep mark /etc/shadow

# Format: username:password:lastchange:min:max:warn:inactive:expire:reserved
# The 8th field (expire) contains the expiry date in days since 1970-01-01
Enter fullscreen mode Exit fullscreen mode

Calculate expiry days: 

# To see what the expiry date looks like in /etc/shadow
echo $(($(date -d "2027-04-15" +%s) / 86400))
Enter fullscreen mode Exit fullscreen mode

Expected Output 

[root@stapp03 ~]# useradd -e 2027-04-15 mark
[root@stapp03 ~]# id mark
uid=1002(mark) gid=1002(mark) groups=1002(mark)
[root@stapp03 ~]# chage -l mark
Last password change                                    : Jul 01, 2026
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : Apr 15, 2027
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7
[root@stapp03 ~]# grep mark /etc/shadow
mark:!!:19904:0:99999:7::20844:
[root@stapp03 ~]#
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

  1. "useradd: user 'mark' already exists": The user already exists. Update the expiry: 
   chage -E 2027-04-15 mark
Enter fullscreen mode Exit fullscreen mode
  1. "Invalid date format": Ensure date is in YYYY-MM-DD format: 
   # Correct
   useradd -e 2027-04-15 mark

   # Incorrect
   useradd -e 15-04-2027 mark
Enter fullscreen mode Exit fullscreen mode
  1. "Permission denied": Ensure you're using sudo or root: 
   sudo useradd -e 2027-04-15 mark
Enter fullscreen mode Exit fullscreen mode
  1. To modify expiry for existing user: 
   chage -E 2027-04-15 mark
Enter fullscreen mode Exit fullscreen mode
  1. To remove expiry: 
   chage -E -1 mark
Enter fullscreen mode Exit fullscreen mode

Security Best Practices

  1. Set a strong password for the temporary user: 
   passwd mark
Enter fullscreen mode Exit fullscreen mode
  1. Set password expiry along with account expiry: 
   chage -M 30 -W 7 mark  # Password expires in 30 days, warn 7 days before
Enter fullscreen mode Exit fullscreen mode
  1. Set a non-interactive shell for service accounts: 
   usermod -s /sbin/nologin mark
Enter fullscreen mode Exit fullscreen mode
  1. Add to specific groups if needed: 
   usermod -a -G developers mark
Enter fullscreen mode Exit fullscreen mode

Complete Solution Summary

The user mark has been created on App Server 3 (stapp03) with:

  • ✅ Username: mark (lowercase)
  • ✅ Account expiry date: 2027-04-15
  • ✅ Verified with chage -l mark
  • ✅ Entry in /etc/shadow with expiry field set
  • ✅ Account will automatically disable on April 15, 2027

This temporary user account with the expiry date meets the Nautilus project's requirements for limited-duration access.

Top comments (0)