Ñu

Shadow file in linux stores interesting information related to the encrypted password and the aging of the password.

The fields are separated by colons “:” the meanning of each field is:

1. Login name.
2. Encrypted password.
3. Number of days since Jan 1st, 1970 since last change.
4. Number of days before password may be changed.
5. Number of days the password is valid.
6. Number of days the user is warned before password is to expire.
7. Number of days after password expires that account is disabled.
8. Number of days since Jan 1, 1970 that account is disabled.
9. Reserved field.

The last time a password was changed(aka “lastchanged”) is on the 3rd field; The format is the number of days since Jan 1st 1970 same for field 8th. Both are not easy to read at first sight. Here an example.

tonyskapunk:$1$8tdbr1QK$RFckv9KgubCMbf5iit8c.1:13939:1:15:3:3::

1. tonyskapunk
2. Password encrypted with md5($1) using salt: 8tdbr1QK and the result is: RFckv9KgubCMbf5iit8c.1 (thisisatest)
3. On day 13939 occur the last password change.
4. Once the password changes it must remain 1 day before changing it again.
5. During 15 days the password is valid.
6. 3 days prior expiration the user will be warned.
7. 3 days after expiration the account is disabled.
8. Not yet expired.
9. Empty

Most of these fields are really simple to read, but is not the same with field 3. an easy way to translate this.

epoch=$(echo $(( $(grep tonyskapunk /etc/shadow |cut -d: -f3) * 86400 )))
perl -e "printf \"%s\n\", scalar(localtime($epoch))"

This will return “Fri Feb 29 18:00:00 2008″ This is the date the password was changed, nice a leap year

Hope someone find it useful.

References

http://linux.die.net/man/5/shadow

http://www.epochconverter.com

Tags: 1970, bash, change, date, days, epoch, lastchange, leap, linux, passwod, shadow, time, year
No Comments