0

I was reading more about how passwords are stored on linux and came across the number of days until password must be changed. The article I was reading says

 The number of days after which password must be changed 
 (99999 indicates user can keep his or her password 
 unchanged for many, many years)]

enter image description here

The 99999 days is around 277 years. I was wondering if in the year 2250 there will be another y2k situation where people's *nix machines using shadow format will not be able to login. Is there a way to set this date to infinity. It seem like a really bad design decision...

1

Yes that will be an issue for password age but don't worry there is going to be a bigger problem before. The year 2038 is going to be problem for unixtimestamp.

Time values that are calculated as a signed 32-bit integer starting from jan 1st 1970 will not be able to encode times after jan 19th 2038.

1
  • This has now been confirmed as fixed in the Linux 5.6 Kernel – RandomHash Feb 3 '20 at 14:17
1

What is the problem?.

It is not a fixed date, it is a difference from the last change. The 99999 days means about 273 years of continuous use after the last time the password was changed (or initially set).

The last time a password was changed is related to UNIX time. A 32 bit signed value of seconds from January 1, 1970. That is now the default counter for UNIX time. By that, the UNIX time will need to be changed before it overflows at (about) year 2038 (~ 19/Jan/2038). Since OpenBSD, NetBSD and the x32 ABI for Linux already use a 64 bit time_t, it seems reasonable to expect that by year 2038 a signed 64 bit will be the default counter. That will allow to keep counting for about 292 giga additional years, or as explained in the NTP part:

The 64 bit second value is enough to provide unambiguous time representation until the universe goes dim.

The "last time a password was changed" is just the UNIX time divided by 24 hours, 60 minutes and 60 seconds. Today, it will be:

$ echo $(( $(date +%s) / 24 / 60 / 60 ))
16837

That is a reduction of about 16 bits ( 2^16=65536 ) from the UNIX time.

In short, make your application able to use a 64 bit UNIX counter, and so:

  What is the problem?
0

if you think that any operating system out there today, is going to be around in year 2250, without any major changes, alleviating potential problems, we have a much bigger issue in our hands than just a stupid password expiration problem. Look what computers came in the past 70 or so years since ENIAC was invented. 230+ years in the future is close to infinity in these terms.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.