Time Stamp for root password change

[itrc55]

Hi,

from which file i can get this message on HP-UX 11.31 trusted system, where this message appeared when i try to change user password.

>>>>>>>>>>>>>>>>>>>>

# passwd mousa

Last successful password change for mousa: Sat Feb  4 15:13:57 2012
Last unsuccessful password change for mousa: NEVER
<<<<<<<<<<<<<<<<<<<<

please i need the full path of this file.

Thanks

[Matti_Kurkela]

The timestamp is stored in the trusted mode password file for that particular user, i.e. /tcb/files/auth/r/root. These values are identified with keywords u_succhg and u_unsucchg.

As the timestamps are encoded in the standard UNIX time_t format, it might be easier to view them with the "getprpw" command:

getprpw -m spwchg,upwchg

The standard command to modify trusted mode user attributes is modprpw, however that command cannot modify these attributes, since the attributes are supposed to reflect the true history of the account/password.

[itrc55]

Hi,

Thank you for your support, but i don't want to use any command to know that.

is there any file saves the last successfully password change for any user by date and time as following

>>>>>>>>>>>>>>>>>>>>

# passwd mousa

Last successful password change for mousa: Sat Feb  4 15:13:57 2012
Last unsuccessful password change for mousa: NEVER
<<<<<<<<<<<<<<<<<<<<

mousa:u_name=mousa:u_id#114:\
        :u_pwd=Ix5T6jQ1AHeA6:\
        :u_auditid#25:\
        :u_auditflag#1:\
        :u_succhg#1328359802:u_pwchanger=root:u_suclog#1328357554:u_lock@:\
        :chkent:

or is there any way to decode the encode time stamp (:u_succhg#1328359802)

Thanks

[Dennis Handly]

>but I don't want to use any command to know that.

What command or executable do you want to use?

>is there any file saves the last successfully password change for any user by date and time as following

No, it is saved in the file mentioned by Matti in time_t format.

>is there any way to decode the encode time stamp (:u_succhg#1328359802)

How about getprpw(1m)?

Otherwise you can look at this topic:

http://h30499.www3.hp.com/t5/System-Administration/userdbget-auth-ftime-how-to-convert-to-a-proper-date-time/m-p/5515275

[Bill Hassell]

The time stamps in the Trusted system database are in Unix Epoch time, that is, the number of seconds since Jan 1, 1970. Decode Epoch seconds like this-

 # perl -le "print scalar localtime(1328359802)"
Sat Feb  4 07:50:02 2012

# perl -le "print scalar localtime(1328357554)"
Sat Feb  4 07:12:34 2012