When a user last changed their password

PasswordRecently I have had the auditors in at my current 9-5. One of the things they wanted to see is when certain users changed their passwords, this was on Solaris and Linux machines.

Below I have shown a couple of simple ways to do this for both Solaris and Linux. If you have a couple of users then you can use the basic commands or at the bottom there is a Perl script which I found on the interwebs. This will show you all the users and the date of when they last changed the password.

As I have not used or written any Perl for a while, I have also rewritten the Perl Script into Python, which I am a lot more comfortable. So whatever your flavour you should be able to find the information out.

One advantage of the scripts are you can run them on both platforms, so in case you can't remember the specific commands.

Solaris

You can use the command : logins -xto

Linux

You can user the command : chage -l username

You could also use this little snippet and pipe it into a file. :

for i in `cat /etc/passwd | cut -f1 -d:`

chage -l $i

done

last_password_changed.pl

#!/usr/bin/perl

# Output date format is YYYY-MM-DD
open( S, "/etc/shadow" );
while( <S> )
{
($user,$lastchg) = (split /:/)[0,2];
@t = localtime( $lastchg*86400 );
printf "User %-8s last changed password %0.4d-%0.2d-%0.2d (%5d)\n",
$user, $t[5]+1900, $t[4]+1, $t[3], $lastchg;
}
close( S );
exit 0;

last_password_changed.py

# Script Name : last_password_changed.py
# Author : Craig Richards
# Created : 08th October 2013
# Last Modified :
# Version : 1.0

# Modifications :

# Description : This will show the last time users changed their passwords

import time

for f in open("/etc/shadow"):
     user=f.rstrip('\n').split(':')[0].ljust(8)
     chdate=f.rstrip('\n').split(':')[2]
     if chdate == "":
          chdate=0
     chgddate=(int(chdate)*86400)
     lastchange=time.strftime('%Y-%m-%d', time.localtime(chgddate))
     print ('User ' + user + ' last changed their password on : ' + lastchange + ' (' + str(chdate) + ')')

I am always interested in your thoughts so if you have any comments or feedback then please feel free to add any comments, or you can mail me here