topic Re: User aging.. in Operating System - HP-UX

User aging..

Roy Colica — Fri, 25 Nov 2005 05:37:29 GMT

All,
do you think is possible to match this requirement? If a user remains unused for 60 consecutive days it must be disabled. If no authorised request for reinstatement is received within a further 30 consecutive days the userid must be deleted.
I think the first can be done with HP-UX trusted, the second? Do you think I've to implement something or could be free?
Can you please help? Thanks.
Roy

Re: User aging..

RAC_1 — Fri, 25 Nov 2005 05:46:31 GMT

Not possible without some scripting. Even the first requirement will also require some scripts to be run and and decide user expiry and disable it. Take it further and delete it as per requirement.

Re: User aging..

Muthukumar_5 — Fri, 25 Nov 2005 05:55:17 GMT

Yes. First requirement you have to go with trusted system (If you want to have normal hp-ux manner).

Two more ways to achive first requirement:

i) last | grep 'username'
gives last successful login. Calculate day difference and remove the user.

ii) You can play with /etc/profile file to achive this as,

# mkdir /var/users/
# Edit /etc/profile as,
echo "`date +'%d %m %y'`" > /var/users/${LOGNAME}

You can compare the contents in /var/users with current date difference and remove the user account with userdel.

Second Requirement:

Use last and lastb command to achive this.

# last | grep 'username'
# lastb | grep 'username'

get the time stamp and produce the latest one in both. See the time stamp difference with current date and remove user id.

hth.

Re: User aging..

Muthukumar_5 — Fri, 25 Nov 2005 06:03:39 GMT

Refer this thread:

http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=855955

To get a date difference.

DAY1=$(cat /var/users/${LOGNAME}
DAY2=$(date +'%d/%m/%y')
typeset -i DIFF=$(( $(caljd.sh ${DT2} - $(caljd.sh ${DT1}) ))
if [[ ${DIFF} -gt 60 ]]
then
userdel
fi

hth.

Re: User aging..

Steven E. Protter — Fri, 25 Nov 2005 06:11:46 GMT

Shalom Roy,

Its possible and the best way to go is trusted system. This conversion makes teh 60 day rule easy to enforce.

The second 30 day until delete is probably better done by policy. When an account becomes disabled, its status is changed and this can be accounted for.

You can build a little report with passwd -sa and probably get your user list.

Take a look at that report output and see if it might be helpful.

Surely this could be done for free, because the best solution is a scripted solution.

SEP

Re: User aging..

Roy Colica — Wed, 28 Dec 2005 12:39:19 GMT

Thanks.