diff --git a/clite/core.js b/clite/core.js
index dc269b8..b00a50b 100644
--- a/clite/core.js
+++ b/clite/core.js
@@ -1756,6 +1756,7 @@ clite.io = {
 
 			fd.node.mode = mode;
 			fd.node.time.change = clite.time.sec();
+			clite.vfs.saveFile(path);
 			return true;
 		}
 		clite.io.chmod = function(pid,path,mode) {
@@ -1782,6 +1783,7 @@ clite.io = {
 				fd.node.uid = uid;
 			if (gid > -1)
 				fd.node.gid = gid;
+			clite.vfs.saveFile(path);
 			return true;
 		}
 		clite.io.lchown = function(pid,path,uid,gid) {
@@ -1803,6 +1805,7 @@ clite.io = {
 				fd.node.uid = uid;
 			if (gid > -1)
 				fd.node.gid = gid;
+			clite.vfs.saveFile(path);
 			return true;
 		}
 
diff --git a/clite/user.js b/clite/user.js
index 39d5ddf..1d08184 100644
--- a/clite/user.js
+++ b/clite/user.js
@@ -189,6 +189,7 @@ clite.commands.load('user',function(args,env,io) {
 	var stdio = io.include('stdio');
 	var stdlib = io.include('stdlib');
 	var auth = io.include('auth');
+	var clite = io.include('clite');
 
 	var shell = null;
 	var group = null;
@@ -603,12 +604,10 @@ clite.commands.load('cookie',function(args,env,io) {
 	var stdlib = io.include('stdlib');
 	var clite = io.include('clite');
 
-	var pw = null;
-
 	function help() {
 		stdio.printf(`
 cookie - set cookie options
-Usage: login [OPTION]
+Usage: cookie [OPTION]
 
 Options:
 -?	Print this help information
@@ -703,4 +702,127 @@ Options:
 	return main(args);
 });
 
+clite.commands.load('passwd',function(args,env,io) {
+	var stdio = io.include('stdio');
+	var stdlib = io.include('stdlib');
+	var term = io.include('term');
+	var auth = io.include('auth');
+
+	var user = null;
+
+	function help() {
+		stdio.printf(`
+passwd - set user passwords
+Usage: passwd [OPTION] [USER]
+
+Options:
+-?	Print this help information
+`);
+	}
+
+	function setPass(pass) {
+		if (pass == String.fromCharCode(4) || pass == 4) {
+			io.exit(1);
+			return;
+		}
+
+		if (!auth.setpassnam(user,pass)) {
+			stdio.write(io.stderr,'internal error\n');
+			io.exit(1);
+			return;
+		}
+
+		io.exit(0);
+	}
+
+	function getPass() {
+		stdio.write(io.stdout,'New Password: ');
+		term.ttyctrl('echo',false);
+		var r = stdio.read(io.stdin,function(p) {
+			term.ttyctrl('echo',true);
+			setPass(p);
+		});
+		if (!r) {
+			term.ttyctrl('echo',true);
+			stdio.write(io.stderr,'internal error\n');
+			io.exit(1);
+		}
+	}
+
+	function checkPass(str) {
+		if (str == String.fromCharCode(4) || str == 4) {
+			io.exit(1);
+			return;
+		}
+		if (!auth.checkpassnam(user,str)) {
+			stdio.write(io.stderr,'authentication error\n');
+			io.exit(1);
+			return;
+		}
+		getPass();
+	}
+
+	function getCurPass() {
+		stdio.write(io.stdout,'Current Password: ');
+		term.ttyctrl('echo',false);
+		var r = stdio.read(io.stdin,function(p) {
+			term.ttyctrl('echo',true);
+			checkPass(p);
+		});
+		if (!r) {
+			term.ttyctrl('echo',true);
+			stdio.write(io.stderr,'internal error\n');
+			io.exit(1);
+		}
+	}
+
+	function main(args) {
+		for (var i=1; i<args.length; i++) {
+			if (args[i][0] == '-') {
+				for (var j=1; j<args[i].length; j++) {
+					switch (args[i][j]) {
+					case '?':
+						help();
+						return 0;
+						break;
+					default:
+						stdio.fprintf(io.stderr,'unknown argument: -%c\n',args[i][j]);
+					}
+				}
+			}else{
+				user = args[i];
+			}
+		}
+
+		if (!user) {
+			let uid = stdlib.getuid();
+			let pw = stdlib.getpwuid(uid);
+			if (pw)
+				user = pw.pw_name;
+		}else{
+			let pw = stdlib.getpwnam(user);
+			if (!pw)
+				user = null;
+		}
+
+		if (!user || user == 'guest') {
+			stdio.fprintf(io.stderr,'no valid user specified\n');
+			return 1;
+		}
+
+		stdio.printf('Changing password for user %s\n',user);
+
+		if (stdlib.geteuid() != 0) {
+			getCurPass();
+			return null;
+		}
+
+		getPass();
+
+		return null;
+	}
+
+	return main(args);
+});
+
 }