The system file /etc/security/passwd records the encrypted form of each user's login password and the time when the password was last modified. Let's take root as an example:
root:
password = xxxx
flags =
lastupdate = 1556451521
Here, lastupdate is Last password modification time, expressed in epoch time.
Use the script to extract the lastupdate value
# cat /etc/security/passwd | grep -p root | grep lastupdate | awk'{print $3}'
1556451521
or:
pwdadm -q root | grep lastupdate | awk'{print $3}'
or:
lssec -f /etc/security/passwd -s root -a lastupdate | awk -F'=''{print $2}'
Conversion time format
# perl -le'print scalar localtime 1556451521'
Sun Apr 28 19:38:41 2019
or :
Perl -e'use POSIX;print ctime(1556451521)'
Therefore, the last time the root user changed his password was 19:38:41 on August 28, 2019.