where are passwd aging parameters stored?

[Jonathan Taylor_3]

If I do a passwd -s to view the aging info for a user's password it shows a date, the minimum # of days required before password change, and the # of days the password is good for. I assume this is all stored in a file somewhere, but haven't been able to find it. Also, what does the date listed in the passwd -s output correlate to?

Thanks in advance.

[A. Clay Stephenson · Accepted solution]

In an untrusted system, the aging paramters are stored as 4 base64-digits in the passwd hash field. They actually represent weeks so the actual resolution is every 7 days beginning on a Thursday because 1-Jan-1970 was a Thursday. They are separated from the hash itself by a comma. Man 4 passwd for details.

Trusted systems store the values in seconds and are stored for each user under /tcb/files/auth/[a-z]/username. These values (if defined for the individual user) override any system-wide defaults defined in /tcb/files/auth/system/defaults.

[Jonathan Taylor_3]

Thanks (slaps head) I glanced right over that in the man page.