How do I lock a user's password?

Question

Most Linux distros I've used have a passwd program which can be used to do things like forcibly expire passwords, or lock them to temporarily prevent password-based login. OS X does have a passed program, but from its manual page, it doesn't seem to have any of these features. The Users & Groups preference pane doesn't seem to offer anything either save for a Reset Password… button, which is really not what I'm looking for.

How do I temporarily disable a user's password in OS X in such a way that I can reenable it without actually changing it?

Answer 1

Use pwpolicy. I don't think all of its options are available with local accounts, but you can certainly disable accounts with it:

sudo pwpolicy -u someusername -setpolicy isDisabled=1

Answer 2

I haven't tested this, but it applies to some unspecified version of OS X, so you might want to be careful (try it with a dummy user account):

For OS X 10.5 or older

Source article from hints.macworld

We can use the command line or NetInfo Manager to accomplish this. I will show the commands via the Terminal command line because it is easier for me. To disable the account, we insert the *:

sudo niutil -insertval . /users/user-in-question passwd '*' 0 

And to re-enable it, we remove the *:

sudo niutil -destroyval . /users/user-in-question passwd '*'

For OS X versions newer than 10.5

See this ServerFault question and the related answers. It's basically an exact duplicate of this question but for "OS X Server", which is basically the same as OS X as far as CLI administration is concerned.

By "disable password", I assume you mean "prevent from logging in". If that is not the case, then please clarify what you actually mean by "disable password", as this is a vague or unclear idea.