Bug 1145256
| Summary: | Document (passwd -S), including time zone usage | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | James <phongsuwan> |
| Component: | passwd | Assignee: | Jiri Kucera <jkucera> |
| Status: | CLOSED ERRATA | QA Contact: | Jan Houska <jhouska> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.0 | CC: | djez, jhouska |
| Target Milestone: | rc | Keywords: | Documentation, Reopened |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | passwd-0.79-5.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:11:12 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
James
2014-09-22 16:37:35 UTC
Thanks for your report. Ultimately, the /etc/shadow field’s granularity of 24 hours is just not precise enough to report the correct password change date. If we output local time, we are relevant to the user but may be mistaken (because the cutoff happens during the local-time-measured day); if we output UTC, we are precise but irrelevant to users (users don’t measure their days in UTC). In either case, users in most timezones will see some password change dates as incorrect. See bug 1019850 for more detailed discussion. The right thing to do is to replace or augment sp_lstchg with a more precise timestamp, and the sssd team I believe has this in their to-do list. Before that happens, changing the timezone in the (passwd -S) output would be a breaking change that neither fixes the problem, nor, in my opinion, is a significant enough improvement to warrant the incompatible change in behavior. While I agree that the actual solution is to use a more precise number, I feel that leaving the situation as is confuses those who wish to use the "-S" arguement. Would you consider having the man page annotated? It's a benign change that would help others realize why they are not seeing the expected output. (In reply to James from comment #3) > While I agree that the actual solution is to use a more precise number, I > feel that leaving the situation as is confuses those who wish to use the > "-S" arguement. > > Would you consider having the man page annotated? It's a benign change that > would help others realize why they are not seeing the expected output. Good idea. At this point -S is completely undocumented anyway, which is also worth fixing. Fixed in upstream commit 02d4478318297d24799b03fa53312da5e3f14a40. https://pagure.io/passwd/c/02d4478318297d24799b03fa53312da5e3f14a40?branch=master VERIFIED:
Output of 'man passwd' command:
NEW pass:
passwd-0.79-5.el7.x86_64
-i, --inactive DAYS
This will set the number of days which will pass before an expired password for this account will be taken to mean that the account is inactive and should be disabled, if
the user's account supports password lifetimes. Available to root only.
-S, --status
This will output a short information about the status of the password for a given account. The status information consists of 7 fields. The first field is the user's
login name. The second field indicates if the user account has a locked password (LK), has no password (NP), or has a usable password (PS). The third field gives the date
of the last password change. The next four fields are the minimum age, maximum age, warning period, and inactivity period for the password. These ages are expressed in
days.
Notes: The date of the last password change is stored as a number of days since epoch. Depending on the current time zone, the passwd -S username may show the date of the
last password change that is different from the real date of the last password change by ±1 day.
This option is available to root only.
Remember the following two principles
Protect your password.
OLD FAIL:
passwd-0.79-4.el7.x86_64
-i, --inactive DAYS
This will set the number of days which will pass before an expired password for this account will be taken to mean that the account is inactive and should be disabled, if
the user's account supports password lifetimes. Available to root only.
-S, --status
This will output a short information about the status of the password for a given account. Available to root user only.
Remember the following two principles
Protect your password.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2257 |