topic Re: Find inactive users in Operating System - HP-UX

Find inactive users

Anthony khan — Tue, 07 May 2002 13:58:09 GMT

Hi,

I am tying to find inactive users or the users never login, I think finger command or -mtime can help, so I can remove those inactive users...Is anyone have a script to get this done.

Thanks

Re: Find inactive users

James R. Ferguson — Tue, 07 May 2002 14:03:23 GMT

Hi Anthony:

A couple of tricks help. You can use 'find' to traverse the $HOME directories of the users looking at the last access date for their '.profile' [assuming their default shell is the Posix or ksh shell] and collect a list for culling.

You can examine the /var/adm/wtmp file (if you keep it) using 'last' and compare its contents to /etc/passwd in a fashion which returns a list of users who do *not* appear in 'wtmp'.

Regards!

...JRF...

Re: Find inactive users

harry d brown jr — Tue, 07 May 2002 14:07:43 GMT

Anthony,

Convert your system to trusted, and set passwd expire and inactivity.

live free or die
harry

Re: Find inactive users

Sachin Patel — Tue, 07 May 2002 14:08:18 GMT

Hi
You can use who to find old logins.
#who -a |grep old
then run ps -e to find out that pid if you can means that login is old you can remove it.

for example
#who -a |grep old
sachin ttyp1 Jan 8 09:47 old 8071 10.20.46.71:0.0
#ps -e |grep 8071
8071 ttyp1 0:00 csh

means that login is been inactive for logtime and it is been old.
#kill 8071

Sachin

Re: Find inactive users

Victor_5 — Tue, 07 May 2002 14:10:27 GMT

Don't use finger since it is a danger command for system security, one solution is implement C2 Trusted System, and turn on auditing system, you can get those info from logs.

Re: Find inactive users

Justo Exposito — Tue, 07 May 2002 14:14:05 GMT

Hi Anthony,

Do you know the command "last"?

Regards,

Justo.

Re: Find inactive users

Roger Baptiste — Tue, 07 May 2002 14:25:03 GMT

hi,

first, get list of users on the box:
cat /etc/passwd | awk '{FS=":";print $1}' >/tmp/list_users

Next, run last command and see when they logged in last on the system, somthing like:
while read -r name
do
last $name | head -1 >>/tmp/user_activity
done
Then, decide on what sort of cut of date you are using for inactivity. If it is for users not logged in this year, do a simple:
grep "2001" /tmp/list_users > inactive_users

BAsed on what you are looking for, you can use greap search pattern accordingly.

Finally to remove those users run
userdel on the list of inactive users.

HTH
raj