Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The file /etc/shadow has a couple date fields that are expressed as the number of days since Jan 1, 1970. Is there an easy way using to get a list of users and the calendar date of the last password change, and the expiration?

Ref: man shadow(5)

share|improve this question
chage -l <username>

Example Output:

Last password change                                    : Dec 17, 2015
Password expires                                        : Mar 16, 2016
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 7
Maximum number of days between password change          : 90
Number of days of warning before password expires       : 14
share|improve this answer

report password status on the named account passwd -S username

for user in $(cut -d: -f1 /etc/passwd); do sudo passwd -S $user; done

share|improve this answer
    
+1 That would works, but not in my particular case. I am gathering information for all users, from a copy of the shadow restored to a temp folder from the backup, I was trying to track down some password changes to see if they are related to a system being potentially compromised. – Zoredache Apr 13 '12 at 19:24
up vote 2 down vote accepted

There was an answer that got deleted, while somewhat wrong, did lead me in the correct direction.

Using gawk's strftime combined with some arithmetic gives me what I wanted.

cat shadow | gawk -F: '{ print $1 ":" strftime("%Y%m%d",86400*$3) ":" strftime("%Y%m%d",86400*$4)}'

root:20120304:19691231
daemon:20100203:19691231
bin:20100203:19691231
sys:20100203:19691231
share|improve this answer
for n in $(sudo cat /etc/shadow | awk '{FS=":";print $3}'); do date -d "01/01/1970 +${n}days" +%F; done 
share|improve this answer

This outputs password update information for each user:

Read the /etc/passwd file >> parse each user >> run chage -l command on each user

for user in $(cut -d: -f1 /etc/passwd); do echo -e "\n $user \n" && chage -l $user; done
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.