Direct Answer
On default Linux Mint systems, an expired password for a non-root user typically does not produce a silent, generic “permission denied.” Instead, the PAM stack detects the expired credential and forces an immediate password change before the session is granted. The exact message—whether a specific expiration notice or a generic failure—depends on the PAM service being used (console login, SSH, sudo, or graphical greeter) and the flags configured for pam_unix.so.
What the PAM Stack Does
Linux Mint relies on PAM for authentication. The pam_unix.so module performs the password check and expiry evaluation. When the password is expired, the module returns a non-zero PAM status—commonly PAM_NEW_AUTHTOK_REQD or PAM_CRED_EXPIRED. In stock Mint and Ubuntu-derived stacks, the login and SSH services usually route this into a mandatory password-change flow rather than rejecting the user outright. If a service stack omits the password-change phase, the same return code can surface as an authentication failure.
Likely vs. Confirmed
- Confirmed: Mint uses PAM;
pam_unix.so handles password expiry. - Likely: On default stacks for recent Mint releases, the user is prompted to change the password immediately.
- Uncertain: The exact error text varies by service, locale, and whether the administrator has customized the PAM file.
Verification Steps
- Check expiry state:
chage -l username to see password and account expiration dates. - Inspect the service stack:
grep pam_unix /etc/pam.d/login (or sshd, sudo, lightdm) to review flags and module ordering. - Review authentication logs:
sudo journalctl -u ssh or sudo tail -n 50 /var/log/auth.log to capture the PAM return code during the attempt.
Missing Diagnostic
Missing diagnostic: Which PAM service is involved—console login, SSH, sudo, or the graphical greeter? The recommendation changes because each service uses a different file under /etc/pam.d/, and some stacks include a mandatory password-change phase while others do not.
linuxmint