CHGPASSWD(8)              System Management Commands              CHGPASSWD(8)

<?><?>
       chgpasswd - <?><?><?><?><?><?><?>

<?><?>
       chgpasswd [options]

<?><?>
       The chgpasswd command reads a list of group name and password pairs
       from standard input and uses this information to update a set of
       existing groups. Each line is of the format:

       group_name:password

       By default the supplied password must be in clear-text, and is
       encrypted by chgpasswd.

       The default encryption algorithm can be defined for the system with the
       ENCRYPT_METHOD variable of /etc/login.defs, and can be overwritten with
       the -e or -c options.

       <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>

<?><?>
       The options which apply to the chgpasswd command are:

       -c, --crypt-method
           <?><?><?><?><?><?><?><?><?><?><?><?>

           The available methods are SHA256, SHA512, YESCRYPT and NONE if your
           libc supports these methods.

       -e, --encrypted
           <?><?><?><?><?><?><?><?><?><?><?><?>

       -h, --help
           <?><?><?><?><?><?><?><?><?><?>

       -R, --root CHROOT_DIR
           Apply changes in the CHROOT_DIR directory and use the configuration
           files from the CHROOT_DIR directory. Only absolute paths are
           supported. No SELINUX support.

       -s, --sha-rounds
           <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>

           You can only use this option with crypt method: SHA256 SHA512
           YESCRYPT

           By default, the number of rounds for SHA256 or SHA512 is defined by
           the SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS variables in
           /etc/login.defs.

           A minimal value of 1000 and a maximal value of 999,999,999 will be
           enforced for SHA256 and SHA512. The default number of rounds is
           5000.

           By default, the number of rounds for YESCRYPT is defined by the
           YESCRYPT_COST_FACTOR in /etc/login.defs.

           A minimal value of 1 and a maximal value of 11 will be enforced for
           YESCRYPT. The default number of rounds is 5.

CAVEATS
       <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>

       <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>

<?><?><?><?>
       The following configuration variables in /etc/login.defs change the
       behavior of this tool:

       ENCRYPT_METHOD (string)
           This defines the system default encryption algorithm for encrypting
           passwords (if no algorithm is specified on the command line).

           It can take one of these values: SHA256, SHA512 (default),
           YESCRYPT. See crypt(5) for recommendations.

           Note: this only affects the generation of group passwords. The
           generation of user passwords is done by PAM and subject to the PAM
           configuration. It is recommended to set this variable consistently
           with the PAM configuration.

           History: This variable is used by other programs, which may still
           default to unsafe algorithms such as DES. To avoid using unsafe
           algorithms, the variable should always be specified.

       MAX_MEMBERS_PER_GROUP (number)
           Maximum members per group entry. When the maximum is reached, a new
           group entry (line) is started in /etc/group (with the same name,
           same password, and same GID).

           <?><?><?><?> 0<?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>

           <?><?><?>(<?><?><?>)<?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>
           NIS <?><?><?><?><?><?> 1024 <?><?><?>

           <?><?><?><?><?><?><?><?><?><?><?><?><?><?> 25<?>

           <?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>(<?><?><?>
           Shadow
           <?><?><?><?>)<?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?><?>

       SHA_CRYPT_MIN_ROUNDS (number), SHA_CRYPT_MAX_ROUNDS (number)
           When ENCRYPT_METHOD is set to SHA256 or SHA512, this defines the
           number of SHA rounds used by the encryption algorithm by default
           (when the number of rounds is not specified on the command line).

           With a lot of rounds, it is more difficult to brute force the
           password. But note also that more CPU resources will be needed to
           authenticate users.

           If not specified, the libc will choose the default number of rounds
           (5000), which is orders of magnitude too low for modern hardware.

           <?><?><?><?> 1000 - 999,999,999 <?><?><?>

           If only one of the SHA_CRYPT_MIN_ROUNDS or SHA_CRYPT_MAX_ROUNDS
           values is set, then this value will be used.

           If SHA_CRYPT_MIN_ROUNDS > SHA_CRYPT_MAX_ROUNDS, the highest value
           will be used.

           Note: this only affect the generation of group passwords. The
           generation of user passwords is done by PAM and subject to the PAM
           configuration. It is recommended to set this variable consistently
           with the PAM configuration.

       YESCRYPT_COST_FACTOR (number)
           When ENCRYPT_METHOD is set to YESCRYPT, this defines the cost
           factor used by the encryption algorithm by default (when the cost
           factor is not specified on the command line).

           With a high cost factor, it is more difficult to brute force the
           password. But note also that more CPU resources will be needed to
           authenticate users.

           The value must be inside the 1-11 range.

           Note: this only affect the generation of group passwords. The
           generation of user passwords is done by PAM and subject to the PAM
           configuration. It is recommended to set this variable consistently
           with the PAM configuration.

<?><?>
       /etc/group
           <?><?><?><?><?><?>

       /etc/gshadow
           <?><?><?><?><?><?><?><?>

       /etc/login.defs
           Shadow <?><?><?><?><?><?><?>

<?><?>
       gpasswd(1), groupadd(8), login.defs(5).

shadow-utils 4.20.0               2026-07-30                      CHGPASSWD(8)