Obtaining value of password change?

[Ender_1]

I'm trying to identify information for all users on the system (HP-UX) regarding their password age. To be specific I would like to identify the location of where information is stored that shows how old the password is. I greatly appreciate the help in advance!

[Patrick Wallek · Accepted solution]

Is this a trusted system? If so, you can get the information by doing:

# /usr/lbin/getprpw
for each user on the system. This will show all kinds of info, including the last password change date. 'man getprpw' for more info.

For either trusted or untrusted do:

# passwd -sa
to show info for all users. It will show the date the passwd was last changed. 'man passwd' for more info.

[Ender_1]

Patrick,

Thank you for the quick response!

Would this command identify the password age information on all versions of the HP-UX OS whether it is trusted or not? Also, would it be possible for you to provide me with a sample of the kind of output I can expect upon running this command?

Thank You,

Ender

[Arturo Galbiati]

HI,
you can use the pwage command as well.
HTH,
Art

[Andrew Merritt_2]

Hi Ender,

Take a look at the man page for passwd(1), under -s and -a, where the output is defined; checking this on the systems you are interested it will also help you tell if it is supported on all of them. I'd suggest also running it on your systems; given what you're asking it seems odd to ask someone else to provide an example when you can do it just as easily.

The format of the output varies depending on whether password aging information is present. Note that you have to be root to run 'passwd -sa', for security reasons.

I don't know where you would get 'pwage' from, it's not part of HP-UX.

Andrew

[Bill Hassell]

The aging information is stored very differently on a Trusted system versus a non-Trusted or shadow password system. For a standard system, the aging details are appended to the encrypted password entry in /etc/passwd while on a Trusted system, it is stored in the /tcb directory structure. For a shadow password system, the aging is also appended to the encyrpted password in the shadow file. So without using a built-in command that knows the differences, there is no single method to extract the aging details. The details about encrypted passwd file age numbers is found in the man page: man 4 passwd. For a Trusted system, the man page for modprpw will be helpful in decoding the aging numbers.

[Ender_1]

All,

Thank you for your quick and insightful responses. The reason I am asking these questions and looking for example outputs is due to the fact that I do not have access to any HP-UX servers. I am gathering information for documentation purposes to help assist those with minimal knowledge in specific areas of HP-UX.

From what I gather, performing the command "passwd -sa" as root will yield the results I am looking for (password age for all accounts) on all systems, correct?

[A. Clay Stephenson]

Another option is to use the "logins -x" command. That will work on trusted or untrusted systems. You should note that regardless of the method, for an untrusted system, the minimum resolution for aging values is 1 week (and weeks start on Thursdays because 1-Jan-1970 fell on a Thursday) whereas with trusted systems the aging parameters actually have 1 second resolution.

[Dennis Handly]

>Clay: weeks start on Thursdays because 1-Jan-1970 fell on a Thursday)

They start on WED if you are west of GMT. Though there may be a day of grace?