Locking user accounts

[Lynda Badger]

Can you lock account after 3 attempts on an untrusted system. If so does someone have an example script.

thanks in advance,
Lynda

[curt larson_1 · Accepted solution]

don't have a script handy, but can give some direction:

in /etc/profile or elsewhere for csh and cde.

set traps so users cant escape to the shell before doing this

use lastb to get the last bad logins
/usr/bin/lastb -3 ${LOGNAME}

use Mr. Stephenson's calendar script to find the time between now and when the last logins occured

http://www.hpux.ws/merijn/caljd.sh
http://www.hpux.ws/merijn/caljd.pl

if the the bad attemps have happened in a certain amount of time, exit.

They won't be able to login again until a certain amount of time has passed.

to really lock them out (ftp and other things that might use the passwd file) you'll have to do something that will modify the users entry in the password file, maybe a script run by sudo.

[Steven E. Protter]

This script will do it for any user.

see attachement.

Is called check_rootlogin but can easily be tweaked to work with any user.

SEP

[Lynda Badger]

Thanks Curt and Steven for your help.

[WSS]

Can someone please tell me where they are putting this script and the syntax for the execution?

Would like to implement this script, so would like to know where it needs to be called from.

Regards,
Trev

[Anand Sreenivasan]

These scripts can be set in a common path which in my servers are /usr/local/bin and with the permission of 755 owned by root. This way, only root can edit but anyone can execute it. Hope this helped..

[TwoProc]

Lynda, sorry to add to your thread,but:

SEP, are running that script with Cron? How often? what command did you use to disable the account? I'd like it disabled (for root), but not for the console. I've got some ideas on how to do this, I was interested to hear how you would do it (b/c of your cool headwear).

Thanks,

John

[WSS]

Anand, Yes of course it needs to reside somewhere on the server, and /usr/local/bin is as good as any ... But it just sits there doing nothing unless something calls it.

Where would this happen? For instance would you put it in each users .profile? I don't think so as this is not read until a successful login. So what do you need to do to have this script working for each user? Where do you execute it from?

Anyone?

Thanks in advance....
Trev