topic Re: Monitoring user accounts in Operating System - HP-UX

Monitoring user accounts

Rob McCarthy — Thu, 04 Sep 2003 19:11:23 GMT

I have a request from the security group at the company that I work for. They would like to get a daily report of users who have not accessed their accounts for the last 90 days. We are a HP-UX 11 i shop running our system in trusted mode. Is their an auditing tool within the OS that will do this? Are there any freeware scripts ou there that would produce this information?

Re: Monitoring user accounts

Mark Grant — Thu, 04 Sep 2003 19:13:24 GMT

Not sure on a trusted system but check out the "last" command

Re: Monitoring user accounts

Steven E. Protter — Thu, 04 Sep 2003 19:15:57 GMT

You should be able to process the output of passwd -sa and produce a report yourself.

Alternatively, you can add a line of code to /etc/profile and log accounts as they get used.

echo $LOGNAME date >> /var/adm/userlog

Then you can process this file against a user list from /etc/passwd and produce a list of users that have not logged in.

Or, A. Clay Stevenson will post in a little perl script.

SEP

Re: Monitoring user accounts

Brian Bergstrand — Thu, 04 Sep 2003 19:20:56 GMT

I have a script to do this, but I can't post it because of company restrictions.

I can tell you what you need to do though:

1. Get the GMT time in seconds. I wrote a hello world style C program that prints the result of the the time() system call to stdout.

2. Loop through each user in the password file (I skip system accounts) and find the corresponding tcb entry. This can be done by grabbing the first char of the login name and then accssing the file in /tcb/files/auth//

The tcb file contains a field called u_suclog that lists the last successful login in GMT seconds since UNIX epoch.

You then compare these two numbers.

This is a very simplified overview, but it should get you started.

I would say to use /usr/lbin/getprpw, but it outputs the date as a human readable string in the local timezone. That makes for harder numeric operations.

HTH.

Re: Monitoring user accounts

A. Clay Stephenson — Thu, 04 Sep 2003 19:25:42 GMT

Brian's approach is basically sound. Rather than using C to get epoch seconds a far simpler method is simply:
NOW=$(perl -e 'print time')

Re: Monitoring user accounts

James R. Ferguson — Thu, 04 Sep 2003 19:29:18 GMT

Hi Rob:

Have a look at 'last'. See the man pages.

Regards!

...JRF...