Security
Showing results for 
Search instead for 
Do you mean 

Time Stamp for root password change

Highlighted
Regular Advisor

Time Stamp for root password change

Hi,

 

from which file i can get this message on HP-UX 11.31 trusted system, where this message appeared when i try to change user password.

 

>>>>>>>>>>>>>>>>>>>>

# passwd mousa

Last successful password change for mousa: Sat Feb  4 15:13:57 2012
Last unsuccessful password change for mousa: NEVER
<<<<<<<<<<<<<<<<<<<<

 

 

please i need the full path of this file.

 

Thanks

4 REPLIES
Honored Contributor Honored Contributor

Re: Time Stamp for root password change

The timestamp is stored in the trusted mode password file for that particular user, i.e. /tcb/files/auth/r/root. These values are identified with keywords u_succhg and u_unsucchg.

 

As the timestamps are encoded in the standard UNIX time_t format, it might be easier to view them with the "getprpw" command:

getprpw -m spwchg,upwchg

 

The standard command to modify trusted mode user attributes is modprpw, however that command cannot modify these attributes, since the attributes are supposed to reflect the true history of the account/password.

MK
Regular Advisor

Re: Time Stamp for root password change

Hi,

 

Thank you for your support, but i don't want to use any command to know that.

 

is there any file saves the last successfully password change for any user by date and time as following

 

>>>>>>>>>>>>>>>>>>>>

# passwd mousa

Last successful password change for mousa: Sat Feb  4 15:13:57 2012
Last unsuccessful password change for mousa: NEVER
<<<<<<<<<<<<<<<<<<<<

 

mousa:u_name=mousa:u_id#114:\
        :u_pwd=Ix5T6jQ1AHeA6:\
        :u_auditid#25:\
        :u_auditflag#1:\
        :u_succhg#1328359802:u_pwchanger=root:u_suclog#1328357554:u_lock@:\
        :chkent:

or is there any way to decode the encode time stamp (:u_succhg#1328359802)

 

Thanks

 

Acclaimed Contributor Acclaimed Contributor

Re: Time Stamp for root password change

[ Edited ]

>but I don't want to use any command to know that.

 

What command or executable do you want to use?

 

>is there any file saves the last successfully password change for any user by date and time as following

 

No, it is saved in the file mentioned by Matti in time_t format.

 

>is there any way to decode the encode time stamp (:u_succhg#1328359802)

 

How about getprpw(1m)?

Otherwise you can look at this topic:

http://h30499.www3.hp.com/t5/System-Administration/userdbget-auth-ftime-how-to-convert-to-a-proper-date-time/m-p/5515275

Honored Contributor Honored Contributor

Re: Time Stamp for root password change

The time stamps in the Trusted system database are in Unix Epoch time, that is, the number of seconds since Jan 1, 1970. Decode Epoch seconds like this-

 

 # perl -le "print scalar localtime(1328359802)"
Sat Feb  4 07:50:02 2012

 

# perl -le "print scalar localtime(1328357554)"
Sat Feb  4 07:12:34 2012