Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

The file /etc/shadow has a couple date fields that are expressed as the number of days since Jan 1, 1970. Is there an easy way using to get a list of users and the calendar date of the last password change, and the expiration?

Ref: man shadow(5)

share|improve this question

3 Answers 3

up vote 2 down vote accepted

There was an answer that got deleted, while somewhat wrong, did lead me in the correct direction.

Using gawk's strftime combined with some arithmetic gives me what I wanted.

cat shadow | gawk -F: '{ print $1 ":" strftime("%Y%m%d",86400*$3) ":" strftime("%Y%m%d",86400*$4)}'

root:20120304:19691231
daemon:20100203:19691231
bin:20100203:19691231
sys:20100203:19691231
share|improve this answer

report password status on the named account passwd -S username

for user in $(cut -d: -f1 /etc/passwd); do sudo passwd -S $user; done

share|improve this answer
    
+1 That would works, but not in my particular case. I am gathering information for all users, from a copy of the shadow restored to a temp folder from the backup, I was trying to track down some password changes to see if they are related to a system being potentially compromised. –  Zoredache Apr 13 '12 at 19:24
for n in $(sudo cat /etc/shadow | awk '{FS=":";print $3}'); do date -d "01/01/1970 +${n}days" +%F; done 
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.