Working with UNIX 'epoch'

An administrator friend was trying to find out on which date the last change of a password occured. He knew that this information was stored in the /etc/shadow file.

Well, the third field of the shadow file contains a number, which is equivalent to number of days from the epoch, which for UNIX was agreed to be January 1, 1970, at midnight, UTC.

So, let's see how we can convert this information into a meaningful date. For example, on my test machine I have:

$ grep root /etc/shadow
root:$1$.LbW0Bv2$keqd6WlAumjwvqRl2tu6U1:13117:0:120:7:::

The conversion is simpler that you may think - no complicated calculations, just yet another useful option of the date command:

$ date -d "1970-01-01 utc + 13117 days"
Wed Nov 30 00:00:00 GMT 2005

The above command means: show the date based on the given "string". The string used here says: use the epoch as the base date, and add to it the value of the 3rd field (for the user of interest) from the /etc/shadow file .

The unit at the end of the string is important! For example, consider the following:

$ date +%s
1137404710
$ date -d "1970/01/01 utc + 1137404710 sec"

Mon Jan 16 09:46:11 GMT 2006

In the above example we first convert the current date into the 'epoch' value, but expressed in seconds (notice that the +%s formatting is only available on the GNU-enhanced versions of date). We then used the date command to convert this number back into a proper date format.

You could use the output of the date command as part of the string used in the calculations. The following is for illustration purposes only, really. It's a long-winded way of finding the 'now' date.

$ date -d "1970-01-01 utc + $(date +%s) sec"

Mon Jan 16 10:02:54 GMT 2006

Finally, the same -d option can be used for creating any date stamp, for example:

$ date

Mon Jan 16 10:26:21 GMT 2006

$ date -d "+ 30 min"

Mon Jan 16 10:56:42 GMT 2006

$ date -d "+ 2 days"
Mon Jan 18 10:58:03 GMT 2006