The file /etc/shadow has a couple date fields that are expressed as the number of days since Jan 1, 1970. Is there an easy way using to get a list of users and the calendar date of the last password change, and the expiration?

Ref: man shadow(5)

6 Answers 6

chage -l <username>

Example Output:

Last password change                                    : Dec 17, 2015
Password expires                                        : Mar 16, 2016
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 7
Maximum number of days between password change          : 90
Number of days of warning before password expires       : 14

report password status on the named account passwd -S username

for user in $(cut -d: -f1 /etc/passwd); do sudo passwd -S $user; done

  • +1 That would works, but not in my particular case. I am gathering information for all users, from a copy of the shadow restored to a temp folder from the backup, I was trying to track down some password changes to see if they are related to a system being potentially compromised.
    – Zoredache
    Apr 13, 2012 at 19:24
for n in $(sudo cat /etc/shadow | awk '{FS=":";print $3}'); do date -d "01/01/1970 +${n}days" +%F; done 

To avoid the useless-use-of-cat-award:

for n in $(sudo awk '{FS=":";print $3}' /etc/shadow); do date -d "01/01/1970 +${n}days" +%F; done 

There was an answer that got deleted, while somewhat wrong, did lead me in the correct direction.

Using gawk's strftime combined with some arithmetic gives me what I wanted.

cat shadow | gawk -F: '{ print $1 ":" strftime("%Y%m%d",86400*$3) ":" strftime("%Y%m%d",86400*$4)}'

  • 1
    be nice and don't gawk at the cat gawk -F: '{ print $1 ":" strftime("%Y%m%d",86400*$3) ":" strftime("%Y%m%d",86400*$4)}' /etc/shadow Mar 17, 2017 at 17:22
  • @ChrisAlderson Meh, the UUOC people won't convince me. I find the cat file | filter | filter more readable, and sometimes when I am being lazy I will do it.
    – Zoredache
    Mar 17, 2017 at 17:56

This outputs password update information for each user:

Read the /etc/passwd file >> parse each user >> run chage -l command on each user

for user in $(cut -d: -f1 /etc/passwd); do echo -e "\n $user \n" && chage -l $user; done

"... the calendar date of the last password change":

$ date -d '01 Jan 1970 19139 days'

19139 from /etc/shadow

One can use all above in a loop.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.