topic Re: Determining last user logon in Operating System - HP-UX

Determining last user logon

Clifton Smith — Mon, 18 Oct 2004 12:03:21 GMT

I administer a trusted system (all password entries in /tcb/files/auth/*), and need some way to determine the last logon of all users in /etc/passwd for a particular system.

Is there any way to use the u_suclog field in the tcb encrypted file or ANY other way to determine for each user in /etc/passwd when their last logon was? We are going to use this for clean up purposes on the system..... Any assistance is GREATLY appreciated..

Re: Determining last user logon

Slawomir Gora — Mon, 18 Oct 2004 12:10:52 GMT

Hi,

you can use command for each user:

last user_name | head -n1

Re: Determining last user logon

Rodney Hills — Mon, 18 Oct 2004 12:10:58 GMT

Would the "last" command work for you?

I've merged the output of "last" with "/etc/passwd" via a perl program and have generated such lists for myself.

-- Rod Hills

Re: Determining last user logon

Steven E. Protter — Mon, 18 Oct 2004 12:14:37 GMT

IF the user logged on since the last time the /var/adm/wtmp file was cleared.

last

will show it.

If not, passwd -sa might provide some useful data or some other variation, though this may only show the last time they changed their password. That isn't useless, may be helpful.

SEP

Re: Determining last user logon

Geoff Wild — Mon, 18 Oct 2004 12:16:08 GMT

last userid

last userid |head -1

Rgds...Geoff

Re: Determining last user logon

Rodney Hills — Mon, 18 Oct 2004 12:19:36 GMT

Here is the perl program I used-

#!/usr/local/bin/perl
# Show last logins for every user in /etc/passwd
#
open(LASTLOGIN,"last|") || die "Can not run 'last' command\n";
while () {
next if $_ eq "";
if (/^wtmp begin/) {$begin=$_ ; next};
($name,$tty,$date)=/(\S+)\s+(\S+)\s+(\S+\s+\S+\s+\S+)/;
$user{$name}=$date unless $user{$name};
}
print $begin;
close(LASTLOGIN);
open(PASSWD,"/etc/passwd") || die "Can not open '/etc/passwd'\n";
while () {
next if /^\+/;
($name,$rest)=split(":");
$user{$name}="**NOT USED**" unless $user{$name};
}
foreach $name (sort keys(%user)) {
printf "%-10s %s\n",$name,$user{$name};
}

HTH

-- Rod Hills

Re: Determining last user logon

Clifton Smith — Mon, 18 Oct 2004 13:08:36 GMT

Rod - Thanks !! This is just what I needed..... I would like to press my luck to ask one more thing, however. I am not very familiar with Perl, and I would like to know how to narrow down the search in /etc/passwd to users with a specific word in their logon path.. For instance, in the POSIX world, it would look something like "grep (string) /etc/passwd". I am unfamiliar with how to insert this into the Perl script that you have submitted. Are you, or anyone in this thread, familiar enough with Perl to add some insight?

Thanks

Re: Determining last user logon

Rodney Hills — Mon, 18 Oct 2004 13:28:01 GMT

If you look at the line

next if /^\+/;

This statement skips those lines that begin with "+". What ever regular expression can be used. Example-

To ignore users who are using ksh.
next if /bin\/ksh/;

You could also replace the follwing split statement with-
($user,$pswd,$uid,$gid,$comment,$path,$shell)=split(":",$_);

Then do comparisons on the a field-
next unless $comment=~/test/;

Would only keep entries with "test" in the comment field (note "unless" clause).

Perl is the swiss army knife for system admins.

HTH

-- Rod Hills

Re: Determining last user logon

Patrick Wallek — Mon, 18 Oct 2004 13:34:33 GMT

An easier, and quicker way to get the last login is:

# /usr/lbin/getprpw -m ulogint user_id

Re: Determining last user logon

Slawomir Gora — Tue, 19 Oct 2004 02:01:42 GMT

Hi,

you can use shell script:

#!/bin/sh

for user in `cat /etc/passwd | awk -F':' '{print $1}'`
do
RES=`last $user | head -n1`
[ "$RES" = "" ] || echo $RES
done

Re: Determining last user logon

doug hosking — Tue, 19 Oct 2004 17:47:09 GMT

Patrick, did you mean slogint instead of ulogint? (successful vs. unsuccessful)