2

I can check that the user is expired or not with:

lsuser -f USERNAME | fgrep expires

But how can I check that the user's password is expired or not? Are there any other "expiring" things that can cause trouble? [so that user can't login, because he can only reach a server through FTP and his password expired, and he can't change it, because he hasn't got SSH access to give out the "passwd" command to update his password.]

3

Is there any chage sort of command on AIX? check /etc/shadow file thats where the expiry information is stored.

Update: It seems there is a passwdexpired subroutine that can be loaded and Checks the user's password to determine if it has expired. However, it seems to be used as root.

http://publib.boulder.ibm.com/infocenter/aix/v6r1/index.jsp?topic=%2Fcom.ibm.aix.basetechref%2Fdoc%2Fbasetrf1%2Fpasswdexpired.htm

This link has excellent documentation of what you would require

http://www.torontoaix.com/scripting/when_pwd_exp

As demonstrated earlier in the above article, the expiry of a password is governed by the maxage attribute.

For example:
maxage=0 means never to expire
maxage=2 means will expire in two weeks.

AIX stores the time in the epoch format in seconds, so first you must determine how many seconds in a week, as this is how maxage measures the time between password expiry, that is in week numbers. There are 86400 seconds in a day, so multiplying that by seven comes in at 604800. So there are 604800 seconds in a week. The next command you need to look at is the pwdadm, which in turn queries the file /etc/security/passwd. This file holds the values in seconds when a user last changed their password. Interrogating the file or using the pwdadm command will return the same result. For this demonstration, let us query the user spoll:

# grep -p "spoll:" /etc/security/passwd
spoll:
        password = EvqNjMMwJzXnc
        lastupdate = 1274003127
        flags =       ADMCHG

# pwdadm -q spoll
spoll:
        lastupdate = 1274003127
        flags = ADMCHG

You can see the lastupdate value in seconds from the above output. In other words, the last time the password was changed: 1274003127

Next, using the lsuser or interrogating the file with /etc/security/user, you can determine the number of weeks before the user spoll password will expire:

# grep -p "spoll:" /etc/security/user
spoll:
        admin = false
        maxage = 4

# lsuser -a maxage spoll
spoll maxage=4

You can see from the above output that the number of weeks before password expiry is 4. The next task is then to multiply the number of seconds in a week by the number of weeks before the user spoll password is due to expire. In this case, it is 4: 604800 * 4

# expr 604800 \* 4
2419200

Next, you need to add the maxage value in seconds (604800 * 4) to the last time the password was changed: 2419200 + 1274003127

# expr 2419200 + 1274003127
1276422327

You can now convert that number of seconds from UNIX epoch into a more meaningful current time presentation. You can use different tools, but for this demonstration you'll use gawk with the strftime function:

# gawk 'BEGIN {print strftime("%c",'1276422327')}'
Sun Jun 13 10:45:27 BST 2010

The above calculation gives the time of the next password expiry. So, you now know that user spoll's password was last changed on ( from the pwdadm command):

# gawk 'BEGIN {print strftime("%c",'1274003127')}'
Sun May 16 10:45:27 BST 2010

And that it will expire on:

Sun Jun 13 10:45:27 BST 2010

------------------Perl script-let--------

#!/bin/perl
use POSIX qw(strftime);
$maxage=4; 
$last_update = 1274003127
$max_week_seconds = 86400 * $maxage;
print strftime("%C ", localtime($max_week_seconds));

0

convertthis-to-normal-time(last-pwdupdate-time-in-seconds+maxage-in-seconds)

  • #!/bin/perl use POSIX qw(strftime); $maxage=4; $last_update = 1274003127 $max_week_seconds = 86400 * $maxage; print strftime("%C ", localtime($max_week_seconds)); – Nikhil Mulley Dec 5 '11 at 8:36
0

You can find out through the System Management Interface Tool (smit). The console version is smitty

  • 2
    Answers generally require more explanation than a mere command name. Please elaborate, or move this to a comment. – jw013 Nov 14 '12 at 14:25
  • I would add to this answer, but I can't find the man page anywhere. Mentioning what flags to give it and what the output will look like would be helpful – Michael Mrozek Nov 14 '12 at 15:22
0

I made this script to check hopefully this helps someone else out:

#!/bin/sh

###############################################################################
# Script Name: aix_chk_user_expires.sh
#
# Author: Chris Alderson
#
# Purpose: Check when a user expires in AIX
#
# NOTES: Please change the value of $oozer to the id you desire to check against
#
##############################################################################

# Set value to specify a user

oozer='<username>'

#get epoch time for the time since last updated
time_since_last_update_in_epoch=$(lssec -f /etc/security/passwd -s $oozer -a lastupdate | cut -d= -f2)
#get the max age number of weeks from luser
max_age=$(lsuser -f $oozer | grep maxage | cut -d= -f2)
#multiply maxage by 7 to get number of days password will last
max_age_in_days=$(echo $((( max_age * 7 ))))
# multiply number of days by how many seconds in a day to get total seconds until change
# We will use this later to add to $time_since_last_update_in_epoch
max_age_in_epoch=$(echo $((( $max_age_in_days * 86400 ))) )
# Create new variable to store the total of max age in seconds and epoch of updated password
time_until_expires_in_epoch=$(echo $((( $max_age_in_epoch + $time_since_last_update_in_epoch ))))

#take epoch times and pass them to perl to give them a readible format
time_last_updated=$(perl -le 'print scalar localtime $ARGV[0]' ${time_since_last_update_in_epoch})


if [[ $max_age -eq 0 ]]; then

    time_of_expiration=$(echo "non-expiring password")
else
    ##take epoch times and pass them to perl to give them a readible format
    time_of_expiration=$(perl -le 'print scalar localtime $ARGV[0]' ${time_until_expires_in_epoch})
fi



echo "${oozer}'s password last updated: $time_last_updated"
echo "${oozer}'s password will expire: $time_of_expiration"

Output looks like this:

user's password last updated: Mon Jul 31 17:00:13 2017
user's password will expire: Mon Oct 23 17:00:13 2017

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.