topic Re: Notifying Users of Mandatory Password Changes in Operating System - Linux

Notifying Users of Mandatory Password Changes

Andrew Kaplan — Wed, 20 Dec 2006 08:31:25 GMT

Hi there --

Is there a script that would notify users that they need to change their passwords within a given timeframe? I know chage will check individual user accounts, but can it be used to check all user accounts and have the results either e-mailed to the administrator or to the various users? Thanks.

Re: Notifying Users of Mandatory Password Changes

George Liu_4 — Wed, 20 Dec 2006 09:10:43 GMT

I have a few. Are you using local accounts or ldap accounts?

Re: Notifying Users of Mandatory Password Changes

Andrew Kaplan — Wed, 20 Dec 2006 09:15:02 GMT

Hi there --

Thanks for your reply. The accounts in question are all local to the machine.

Re: Notifying Users of Mandatory Password Changes

George Liu_4 — Wed, 20 Dec 2006 12:34:31 GMT

#!/bin/bash

users=`grep -v ":\!\!:" /etc/shadow|grep -v ":\*:" |grep -v root|cut -f1 -d:`
expire_time=90
today=$(( `perl -le 'print time'` / 86400 ))

for user in $users ; do
last_change=$(( `grep $user /etc/shadow |cut -f3 -d:` ))
days_left=$(( $expire_time - $today + $last_change ))
if [ $days_left -lt 15 -a $days_left -ge 0 ]; then
user_mail=`grep $user /etc/passwd|cut -f5 -d: `
# echo
# echo "ATTENTION: The password of $user will expire in $days_left days.\n"

mail -s "Your password on xxx system will expire in $days_left" $user_mail << EOF
Hello,
Your password of account $user, which is used for accessing xxx server on
host `uname -n`, will expire in $days_left days.

Please update your password.

Thanks for your support!

EOF

fi
done

Re: Notifying Users of Mandatory Password Changes

Andrew Kaplan — Wed, 20 Dec 2006 15:16:18 GMT

Hi there --

I created the script according to the text that your posted in the forum. When I ran the script a series of messages appeared indicating problems sending to the address , and then to the adderss .

What changes should I make to correct this? Thanks.

Re: Notifying Users of Mandatory Password Changes

James R. Ferguson — Wed, 20 Dec 2006 15:59:20 GMT

Hi Andrew:

The format and contents of the fifth field (one-relative) of '/etc/passwd' is left to an administrator's discretion. George's script appears to assume that the fifth field contains a string that represents a valid email address. Your 'passwd' database apparently does not follow this convention.

You can simply create mail to the account on the server that you are examining with this change:

...
if [ $days_left -lt 15 -a $days_left -ge 0 ]; then
mail -s "Your password on xxx system will expire in $days_left" $user << EOF
Hello,
Your password of account $user, which is used for accessing xxx server on
host `uname -n`, will expire in $days_left days.
Please update your password.
Thanks for your support!
EOF

...Note that I dropped the line:

user_mail=`grep $user /etc/passwd|cut -f5 -d: `

...and used ${user} in lieu of ${user_mail} for the mail account.

Regards!

...JRF...

Re: Notifying Users of Mandatory Password Changes

George Liu_4 — Wed, 20 Dec 2006 16:20:36 GMT

My original script is used to get mail address from different database so I leave the way as it is.

Re: Notifying Users of Mandatory Password Changes

Andrew Cowan — Thu, 21 Dec 2006 03:12:42 GMT

"passwd -w" will start to warn users once their password comes within a certain number of days before expiry.