LinuxQuestions.org - Is normal for /etc/shadow to change it's timestamp?

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - Is normal for /etc/shadow to change it's timestamp? (https://www.linuxquestions.org/questions/linux-newbie-8/is-normal-for-etc-shadow-to-change-its-timestamp-823452/)

Is normal for /etc/shadow to change it's timestamp?

I noticed that file /etc/shadow changed it's timestamp.

Why it is changed? Is it "normal"?

Thank you in advance!

You need to be more clear here. *nix files don't have a single timestamp, they have three. These are named mtime, ctime, and atime.

mtime is the time of last modification. This means the last time the contents of the file were changed. Note that there is no "creation" time in *nix, the mtime is the closest you have (it's helps to understand this if you think of a modification as erasing the old file and creating a new one).

ctime is the time of last change, that is, the last time the inode metadata was modified. This happens when the file is modified of course, but also at other times, such as when the permissions or ownership are changed, or the file is moved.

atime is the time of last access, the last time the file was read. However one of the odd quirks of the posix standard is that it defines any access of the file inode at all as reading. This includes simply running ls on the directory, so the atime changes quite often by default.

Because the last quirk can be annoying, and in the case of flash drives even leads to shorter hardware life due to excessive write calls, there are some mount options that you can use to control when atime is updated. You can use noatime to disable updating completely, or relatime, which makes it so that atime only updates if ctime or mtime have also changed. I personally recommend using relatime for most of your drives, particularly flash-based ones.

There are a few more atime based options available. Check out the mount man page.

when i run command:

Code:

[root@myserver ~]# ls -l /etc/shadow*

-r--------  1 root    root        1721 Aug  2 02:52 /etc/shadow

-r--------  1 root    root        1722 Aug  2 02:51 /etc/shadow-

[root@myserver ~]#

will i always get this result, in a case that no user has changed his password?

Well, the time listed by ls -l is the mtime, so it should only change when the file is modified.

What I don't know is whether there are any system functions other than a password/user change that can modify the file. I don't personally know enough about the shadow file to say.