topic Re: Locked Account notification in Operating System - HP-UX

Locked Account notification

Belinda Dermody — Tue, 13 Mar 2001 15:21:06 GMT

I am running a trusted system on a K200 box with HP-UX 10.20. Is there anyway that the system can send a mail msg to root when a user disables his account after 3 failed login attempts.

Re: Locked Account notification

Wodisch — Tue, 13 Mar 2001 22:18:54 GMT

Hello James,

AFAIK no way - at least no "nice" way of doing it.
The crude way could be like scanning all the users's
file below "/tcb/files/auth/?/" for the flag for being
locked and being "newer" than a flag-file:

find /tcb/files/auth/? -newer /tcb/lasttime -print |
while read name; do
if grep "u_lock..." >/dev/null
then echo $name |mailx -slocked-user root
fi
done
touch /tcb/lasttime

and schedule that via "cron" say, every half hour, or so.
I am just not certain about the "u_lock..." part, check
with a locked user on your system to get that right.

HTH,
Wodisch

Re: Locked Account notification

Belinda Dermody — Wed, 14 Mar 2001 14:58:08 GMT

Additonal Info. I was afraid that would be the answer. So I modified the support user menu system that I wrote (SAM is to darn slow) and by using the getprpw command and thanks to dutchworks who provided the man pages. I was able to add another option to display user information for disable accounts on a trusted system.

Re: Locked Account notification

Dieter Degrendele_1 — Mon, 19 Mar 2001 10:25:30 GMT

Hi,

I do following:

Since all suspended users generate a message in /var/adm/syslog/syslog.log I do a tail -f of this file with a grep on "suspended for password violations". You can redirect the output to sendmail. Put all of this in the cron and here you are, the soup is ready!

Rgds,
DD

Re: Locked Account notification

Belinda Dermody — Tue, 20 Mar 2001 16:44:54 GMT

Since all suspended users generate a message in
/var/adm/syslog/syslog.log I do a tail -f of this file with a grep
on "suspended for password violations". You can redirect the
output to sendmail. Put all of this in the cron and here you
are, the soup is ready!

Rgds,
DD
In response to this reply. I do not know what you might have running to generate the message password violations to the syslog. I do not generate that msg when a user locks him/her out.