Determine Password Age

This is the beginning of the core of the script. First we determine how many days have passed since the password was last changed. Then we evaluate this number to determine if the user should start receiving notifications that his account is about to be disabled.

    days_since_change=$(($days_since_epoch-$pass_days))
    if [ $days_since_change -lt $notify ]
    then

A locked account is indicated by the first character of the password; when the script locks an account, it changes the user's encrypted password string to a string of the form *CLOSED_${the_date}*. If the password is still young, no action needs to be taken against the account. However, we should check to see if the account has already been locked, and if so, append a notice to the report.