/etc/shadow date of last password change—UTC or local time

datepasswordtimetimezone

man 5 shadow gives the following description of the third field in each line:

The date of the last password change, expressed as the number of days since Jan 1, 1970.

The value 0 has a special meaning, which is that the user should change her pasword the next time she will log in the system.

An empty field means that password aging features are disabled.

Does this refer to times in UTC or the local timezone? In particular, if I want to calculate comparable numbers using something like $(( $(date +%s) / 86400 )), do I need to pass date the -u option?

Best Answer

The "seconds since 1970" timestamp is specifically defined as UTC in most usages. In particular, you may notice that date +%s gives the same result as date -u +%s.

The relevant line where this is set in the shadow password utilities is"

nsp->sp_lstchg = (long) time ((time_t *) 0) / SCALE;

Which would make it UTC. SCALE is defined as 86400 (except via a specific ifdef that I can't quite trace what circumstances cause to be defined)

Related Question