topic Re: User Add/Delete Date in Operating System - HP-UX

User Add/Delete Date

Nellian Solaiappan — Wed, 26 Jan 2005 16:58:31 GMT

Hi
My production server is running HP-UX 11.0 in a trusted server mode. I need to get the dates in which the exisiting users were created. Also, I need to get the list of users which were removed from the system and date of deletion.
I have been trying to look into samlog and all .sh_hist_dir logs but these are of very little use.
Is there any way to get what I want?

Regards
Nell

Re: User Add/Delete Date

Patrick Wallek — Wed, 26 Jan 2005 17:03:39 GMT

There is no way that I can think of to get the information you need.

samlog is a good idea, but if the users weren't created or deleted with SAM then you're out of luck.

You **MIGHT** be able to get a creation date by looking at the date stamp on the users .profile file or something. But that would change if the file has ever been modified, so there is no guarantee that that will be correct.

I know of no way to get the date a user was deleted.

Re: User Add/Delete Date

A. Clay Stephenson — Wed, 26 Jan 2005 17:08:28 GMT

Because of the number of ways these tasks could be done (some might leave traces and others would not) is legion there is really no way to do what you want after the fact. About as close as you are going to get is the ctime value for the users entry in /tcb/files/auth/x/xuser --- but that is really not a reliable method because the ctime would change anytime did a chmod, for example, on the file.

You really have to handle all this logging yourself (via scripts) and then force your admins to use exactly one method to add and remove users.

Re: User Add/Delete Date

Steven E. Protter — Wed, 26 Jan 2005 18:38:11 GMT

Our user add process, which was written by an outside consulting before I knew Unix(enhanced several times by me) logs user create times in a file.

As A. Clay notes, our operations department is required to use this program. Only systems administration is allowed to add users on the command line.

SEP

Re: User Add/Delete Date

Nguyen Anh Tien — Wed, 26 Jan 2005 22:13:10 GMT

As i know. native HP_UX does not support this feature. You can change userdel to other name and write onother userdel script. in this script you log all action.
I recommand you use Security SW such as Etrust Access Control
refer to this web for more:
http://www3.ca.com/Solutions/Product.asp?ID=154

Re: User Add/Delete Date

Ravi_8 — Thu, 27 Jan 2005 00:20:04 GMT

Hi,

No way you can get this info

Re: User Add/Delete Date

Nellian Solaiappan — Thu, 27 Jan 2005 15:30:58 GMT

Thanks guys
For all your suggestions. Since we are creating and deleting users to Tivoli Identity manager, I need to hide the useradd/userdel commands and replace them with scripts that would inturn call the useradd/userdel commands respectively and log addition or deletion into a file.

Regards
Nell