My understanding is that the last change date(in
/etc/shadow) is the number of days since 01/01/1970 that the password was changed, but I'm seeing numbers like 19708 which translate to 17/12/2023 (future). How is it so?
Your understanding is correct, at least on Linux. And I've confirmed that my accounts show sane dates. Two possibilities come to mind:
- You—or a prior admin—used
chage -d(or direct editing) to change the expire date. Possibly this was done to prevent password expiration, by making the last change date (and thus expiry date) in the distant future. (Why admin didn't use
chage -M, I can't say)
- As cjm said, the password was changed when the clock was set very wrong. Somewhat unlikely, as wrong clocks seem to be in the past more often than the future. (Because a BIOS battery dies, and sets the clock to the minimum date the BIOS authors thought reasonable.)