topic Re: I need help finding a way to search for disabled account in Operating System - HP-UX

I need help finding a way to search for disabled account

skt_skt — Fri, 26 Oct 2007 15:27:30 GMT

I need help finding a way to search for disabled account in linux

Re: I need help finding a way to search for disabled account

skt_skt — Fri, 26 Oct 2007 15:28:28 GMT

disabled/deactivated..

Re: I need help finding a way to search for disabled account

Patrick Wallek — Fri, 26 Oct 2007 15:41:24 GMT

Run a 'passwd -Sa' (that is a capital S and a lowercase a) and look for accounts that have an 'LK' in the 2nd column. Those accounts are locked.

Re: I need help finding a way to search for disabled account

OldSchool — Fri, 26 Oct 2007 15:56:58 GMT

Patrick...you missed the "in linux" part
he's got 2 posts in the Linux forums as well.

Re: I need help finding a way to search for disabled account

Patrick Wallek — Fri, 26 Oct 2007 16:16:59 GMT

Umm...No I didn't miss the "Linux" part.

I ran the "passwd -Sa" on my SuSE Linux Enterprise Server 10 machine and it works great.

Now since he didn't mention WHICH LINUX, I can't be responsible if what works on my SLES box doesn't work on his "other Linux flavor" box.

Re: I need help finding a way to search for disabled account

skt_skt — Fri, 26 Oct 2007 18:43:57 GMT

let me be clear; i am looking for an answer in HP-UX since it is an HP-UX forum. I have a separate question in linux.(i forgot to remove "linux" filed while posting the similar question in HP-UX forum).

[/root] /usr/lbin/getprpw kumarts
uid=19806, bootpw=NO, audid=2351, audflg=1, mintm=-1, maxpwln=-1, exptm=-1, lftm=-1, spwchg=Mon Oct 15 15:17:03 2007, upwchg=Fri Sep 7 15:53:26 2007, acctexp=-1, llog=-1, expwarn=-1, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Fri Oct 26 19:18:49 2007, ulogint=Fri Oct 26 09:05:52 2007, sloginy=tty, culogin=-1, uloginy=-1, umaxlntr=-1, alock=NO, lockout=0000000

the value lockout=0000000 tells me the account is NOT locked.

May be i am confused with account deactivated and locked. is there a diffrence between deactivated and locked state.

My intention is to delete the deactivated accounts. But i DONT want the accounts to be deleted whihc are locked (example due to 5 login failures; a needed account can be in locked state at that point of time).

So i want to identify only deactivated accounts?

here my concern i see some of the accounts are in deactivated state but they are still in use/can be used.This i observed for set of ftp accounts and thier properties are below.(Please note that this accounts was recreated recently as the account was deleted assuming not in use/deactivated; so you can see new dates for spwchg,slogint now)

/usr/lbin/getprpw amsboa01
uid=154, bootpw=NO, audid=2740, audflg=1, mintm=0, maxpwln=-1, exptm=0, lftm=0, spwchg=Thu Oct 25 09:05:39 2007, upwchg=-1, acctexp=-1, llog=0, expwarn=0, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Thu Oct 25 08:43:26 2007, ulogint=-1, sloginy=-1, culogin=-1, uloginy=-1, umaxlntr=-1, alock=NO, lockout=0000000

did i get that correct(accounts are in deactivated state but they are still in use)?if that is correct/incorrect , how we can explain that scenario?

Re: I need help finding a way to search for disabled account

Patrick Wallek — Fri, 26 Oct 2007 20:04:01 GMT

If you are on HP-UX 11.11 or higher then do a 'man getprpw' and look for the "lockout" section. There you will see what each position of the 'lockout=0000000' means. Each position mean a different thing.

The bottom line though is if ANY position has a '1' in it, then the user can't login.

Re: I need help finding a way to search for disabled account

Sachin Rajput — Fri, 26 Oct 2007 23:06:38 GMT

WWhy don't you check in /etc/passwd file.The entries having * for there passwd field are the disabled ones.

Re: I need help finding a way to search for disabled account

skt_skt — Sat, 27 Oct 2007 20:13:59 GMT

i know about this 7 bits.

REASON[1]="past password lifetime"
REASON[2]="past last login time"
REASON[3]="past absolute account lifetime"
REASON[4]="exceeding unsuccessful login attempts"
REASON[5]="password required and a null password"
REASON[6]="admin lock"
REASON[7]="password is a *"

So did u mean if the account is locked(one of the bits is one) the account is in "deactivated" state?

Re: I need help finding a way to search for disabled account

Patrick Wallek — Sat, 27 Oct 2007 21:46:35 GMT

You said: "So did u mean if the account is locked(one of the bits is one) the account is in "deactivated" state?"

If there is a '1' in ANY position in the lockout string, then the user CANNOT login. Whether you call that locked, disabled or deactivated is entirely up to you.

Re: I need help finding a way to search for disabled account

Patrick Wallek — Sat, 27 Oct 2007 21:50:05 GMT

Note to Sachin Rajput:

You said: " WWhy don't you check in /etc/passwd file.The entries having * for there passwd field are the disabled ones."

Since Santhosh asked about the output of the getprpw command, specifically the "lockout" value, that indicated that this system is set up as a TRUSTED system. If you review how a trusted system works, you will discover that ALL account have a '*' in the passwd field in the /etc/passwd file. That is because the password is NOT actually stored there. The passwords are stored in the /tcb/files/auth/* directory structure.

In this case the '*' does NOT indicate the account is disabled.

Re: I need help finding a way to search for disabled account

Tim Nelson — Mon, 29 Oct 2007 11:04:19 GMT

awk -F: '{print $1}|while read list
do
/usr/lbin/getprpw -m lockout $list|awk -F= '$2 != "0000000" {print "DEACTIVATED"}'
done

Add your own tweaks as needed.

Re: I need help finding a way to search for disabled account

Tim Nelson — Mon, 29 Oct 2007 11:15:41 GMT

ooops.

awk -F: '{print $1} /etc/passwd|while read list
do
/usr/lbin/getprpw -m lockout $list|awk -F= '$2 != "0000000" {print "DEACTIVATED"}'
done

Re: I need help finding a way to search for disabled account

skt_skt — Sun, 18 Nov 2007 19:22:01 GMT

closig with the current informations. Thanks to all.

Re: I need help finding a way to search for disabled account

skt_skt — Sun, 18 Nov 2007 19:22:19 GMT

closig with the current informations. Thanks to all.