not getting last Password change time on AIX by default lsuser command

Question

I need all attributes for all users from AIX system for this I am using "lsuser -f ALL command" this gives me all attributes but not giving lastupdate attribute which used to indicate last password change dateTime of user. for getting lastupdate attribute I have to execute one more command lsuser -a lastupdate ALL .

Is there any way or configuration to get lastupdate in default lsuser command like all other attributes??? (It seems like lsuser not reading etc/security/passwd file byDefault) Thanks in advance

Answer 1

The lastupdate field is stored in a file that is (should be) readable only by the root user, so you will need to use sudo or some other privilege escalation method to run lsuser. Note this section of the lsuser man page, with my emphasis in bold:

Access Control: This command must be a general user program with execute (x) access for all users. Since the attributes are read with the access rights of the user who starts the command, some users might not be able to access all the information. This command must have the trusted computing base attribute.

Sample /etc/security directory permissions:

drwxr-x---   11 root     security      11378 Nov 13 19:40 /etc/security

Sample /etc/security/passwd file permissions:

-rw-r-----    1 root     security     19664 Nov 14 12:54 /etc/security/passwd

Sample /etc/security/passwd contents (showing the lastupdate field):

user:
        password = O/jxmbjWeafOfyUw
        lastupdate = 1510064402

Further reading:

• Password expiry, on IBM.com