In this chapter, we've already covered a bit of password management, since I've given you a few examples of the passwd command. If you recall, the passwd command allows us to change the password of the currently logged-in user. In addition, using passwd as root (and supplying a user name) allows us to change the password for any user account on our system. But that's not all this command can do.
One thing I've neglected to mention in regards to the passwd command is the fact that you can use it to lock and unlock a user's account. There are many reasons why you may want to do this. For instance, if a user is going on vacation or extended leave, perhaps you'd want to lock their account so that it cannot be used while they are away. After all, the fewer active accounts, the lower your attack surface. To lock an account, use the -l option:
# passwd -l <username>
And to unlock it, use the -u option:
# passwd -u <username>