How to check that a user/password is expired in AIX?

Question

I can check that the user is expired or not with:

lsuser -f USERNAME | fgrep expires

But how can I check that the user's password is expired or not? Are there any other "expiring" things that can cause trouble? [so that user can't login, because he can only reach a server through FTP and his password expired, and he can't change it, because he hasn't got SSH access to give out the "passwd" command to update his password.]

Answer 1

Is there any chage sort of command on AIX? check /etc/shadow file thats where the expiry information is stored.

Update: It seems there is a passwdexpired subroutine that can be loaded and Checks the user's password to determine if it has expired. However, it seems to be used as root.

http://publib.boulder.ibm.com/infocenter/aix/v6r1/index.jsp?topic=%2Fcom.ibm.aix.basetechref%2Fdoc%2Fbasetrf1%2Fpasswdexpired.htm

This link has excellent documentation of what you would require

http://www.torontoaix.com/scripting/when_pwd_exp

As demonstrated earlier in the above article, the expiry of a password is governed by the maxage attribute.

For example:
maxage=0 means never to expire
maxage=2 means will expire in two weeks.

AIX stores the time in the epoch format in seconds, so first you must determine how many seconds in a week, as this is how maxage measures the time between password expiry, that is in week numbers. There are 86400 seconds in a day, so multiplying that by seven comes in at 604800. So there are 604800 seconds in a week. The next command you need to look at is the pwdadm, which in turn queries the file /etc/security/passwd. This file holds the values in seconds when a user last changed their password. Interrogating the file or using the pwdadm command will return the same result. For this demonstration, let us query the user spoll:

# grep -p "spoll:" /etc/security/passwd
spoll:
        password = EvqNjMMwJzXnc
        lastupdate = 1274003127
        flags =       ADMCHG

# pwdadm -q spoll
spoll:
        lastupdate = 1274003127
        flags = ADMCHG

You can see the lastupdate value in seconds from the above output. In other words, the last time the password was changed: 1274003127

Next, using the lsuser or interrogating the file with /etc/security/user, you can determine the number of weeks before the user spoll password will expire:

# grep -p "spoll:" /etc/security/user
spoll:
        admin = false
        maxage = 4

# lsuser -a maxage spoll
spoll maxage=4

You can see from the above output that the number of weeks before password expiry is 4. The next task is then to multiply the number of seconds in a week by the number of weeks before the user spoll password is due to expire. In this case, it is 4: 604800 * 4

# expr 604800 \* 4
2419200

Next, you need to add the maxage value in seconds (604800 * 4) to the last time the password was changed: 2419200 + 1274003127

# expr 2419200 + 1274003127
1276422327

You can now convert that number of seconds from UNIX epoch into a more meaningful current time presentation. You can use different tools, but for this demonstration you'll use gawk with the strftime function:

# gawk 'BEGIN {print strftime("%c",'1276422327')}'
Sun Jun 13 10:45:27 BST 2010

The above calculation gives the time of the next password expiry. So, you now know that user spoll's password was last changed on ( from the pwdadm command):

# gawk 'BEGIN {print strftime("%c",'1274003127')}'
Sun May 16 10:45:27 BST 2010

And that it will expire on:

Sun Jun 13 10:45:27 BST 2010

------------------Perl script-let--------

#!/bin/perl
use POSIX qw(strftime);
$maxage=4; 
$last_update = 1274003127
$max_week_seconds = 86400 * $maxage;
print strftime("%C ", localtime($max_week_seconds));

---

Answer 2

convertthis-to-normal-time(last-pwdupdate-time-in-seconds+maxage-in-seconds)

Answer 3

You can find out through the System Management Interface Tool (smit). The console version is smitty

Answer 4

I made this script to check hopefully this helps someone else out:

#!/bin/sh

###############################################################################
# Script Name: aix_chk_user_expires.sh
#
# Author: Chris Alderson
#
# Purpose: Check when a user expires in AIX
#
# NOTES: Please change the value of $oozer to the id you desire to check against
#
##############################################################################

# Set value to specify a user

oozer='<username>'

#get epoch time for the time since last updated
time_since_last_update_in_epoch=$(lssec -f /etc/security/passwd -s $oozer -a lastupdate | cut -d= -f2)
#get the max age number of weeks from luser
max_age=$(lsuser -f $oozer | grep maxage | cut -d= -f2)
#multiply maxage by 7 to get number of days password will last
max_age_in_days=$(echo $((( max_age * 7 ))))
# multiply number of days by how many seconds in a day to get total seconds until change
# We will use this later to add to $time_since_last_update_in_epoch
max_age_in_epoch=$(echo $((( $max_age_in_days * 86400 ))) )
# Create new variable to store the total of max age in seconds and epoch of updated password
time_until_expires_in_epoch=$(echo $((( $max_age_in_epoch + $time_since_last_update_in_epoch ))))

#take epoch times and pass them to perl to give them a readible format
time_last_updated=$(perl -le 'print scalar localtime $ARGV[0]' ${time_since_last_update_in_epoch})


if [[ $max_age -eq 0 ]]; then

    time_of_expiration=$(echo "non-expiring password")
else
    ##take epoch times and pass them to perl to give them a readible format
    time_of_expiration=$(perl -le 'print scalar localtime $ARGV[0]' ${time_until_expires_in_epoch})
fi



echo "${oozer}'s password last updated: $time_last_updated"
echo "${oozer}'s password will expire: $time_of_expiration"

Output looks like this:

user's password last updated: Mon Jul 31 17:00:13 2017
user's password will expire: Mon Oct 23 17:00:13 2017