Red Hat Bugzilla – Bug 89759
"User last changed password" has the wrong date
Last modified: 2007-04-18 12:53:20 EDT
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3a) Gecko/20021207 Phoenix/0.5 Description of problem: I created a brand new user today (Sun Apr 27 12:23:09 PDT 2003 ), but under "User Properties: Password Info", it says: "User last changed password on: Sat Apr 26 2003" , which was yesterday. This is incorrect. I last change the password today (Sun Apr 27 2003). If I look for my user with the /etc/shadow file, I see the following: # grep foo /etc/shadow foo:asdasd:12169:-1:99999:-1::: The third field says "12169", which is "Days since Jan 1, 1970 that password was last changed" according to the man page (man 5 shadow). Jan 1, 1970 + 12169 days = Sun Apr 27, 2003 (today). Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. Run redhat-config-users 2. Click "Add user" and add a new user 3. Hit "Ok" 4. Select user, hit the "Properties" button 5. Click on the "Password Info" tab 6. Look and see that the box says: "User last changed password on: Sat Apr 26 2003" Actual Results: I see "User last changed password on: Sat Apr 26 2003" Expected Results: I expected to see "User last changed password on: Sun Apr 27 2003" Additional info:
Perhaps there's a time-zone issue going on here?
Yeah. Here: The epoch is Jan 1, 1970 *GMT*. On the East Coast, that's an offset of 4 or 5 hours (stupid DST). Say you change your password at 11 pm EDT April 26th. That's 3 am GMT, so the value that gets written to the file should be that for the next day, 12169. On the other side of the line, if you change it at 3 pm EDT April 27, that's 7 pm the same day GMT, and the value that gets written is the same as the one for the local day. Then, when reading these values back: if you apply the local timezone (which redhat-config-users does, since it uses Python's ctime function), passwords set in the first part of the day (before midnight GMT -- most of the day in the western hemisphere) are shown as having been changed the previous day. The catch is, there's no way to tell which part of the day in which a password was set, so if you attempt to re-compensate by adding in the timezone shift, you'll be off the other direction for passwords set in the last hours. So that's no good. My suggestion: just add the string " GMT" to the date as shown.
I took your advice and changed it to just list the date in GMT, so it avoids the timezone problem. I'm not using ctime anymore. Instead I'm using gmtime() and running that through asctime() to get some decent formatting. Should be fixed in redhat-config-users-1.1.12-1. Thanks for your report.