Account expiration in trusted systems !!

[Whitehorse_1]

Admins,

Which exact lock-out value below says the account is EXPIRED..

> /usr/lbin/getprpw abcd
uid=8175, bootpw=NO, audid=221, audflg=1, mintm=-1, maxpwln=-1, exptm=-1, lftm=-1, spwchg=Tue Jul 24 10:51:34 2007, upwchg=Mon Jul 3 15:45:54 2006, acctexp=-1, llog=-1, expwarn=-1, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Wed Aug 8 15:04:14 2007, ulogint=Mon Jul 23 02:06:29 2007, sloginy=tty, culogin=-1, uloginy=-1, umaxlntr=-1, alock=NO, lockout=0000000

[A. Clay Stephenson]

Well since lockout=0000000, none of them do.

A '1' in position 1 would indicate the password is beyond its lifetime.

A '1' in position 2 would indicate that a password is beyond the last login time (ie an inactive account).

A '1' in position 3 would indicate that a password is beyond its absolute lifetime.

A '1' in position 4 would indicate too many failed attempts.

A '1' in position 5 would indicate a password is required but the current password is null.

A '1' in position 6 would indicate that the account has been locked by root.

A '1' in position 7 indicates that the password hash is '*'.

You should note that any or all of these could be true simultaneously.

[Juan M Leon]

I got the answer from the man (man page, LOL).
hope it helps

lockout returns the reason for a lockout in a "bit" valued
string, where 0 = condition not present, 1 is
present. The position, left to right represents:

1 past password lifetime
2 past last login time (inactive account)
3 past absolute account lifetime >**This is the answer****<
4 exceeded unsuccessful login attempts
5 password required and a null password
6 admin lock
7 password is a *

[Whitehorse_1]

Thanks Steve for your reply.. My requirement is to list out all accounts which are EXPIRED,, not LOCKED.. its a trusted system..

-- WH

[A. Clay Stephenson · Accepted solution]

Here's a fairly complete example leveraging the logins command and interpreting "expired" to mean any user that has a '1' in any of the 1st 3 lockout positions:

-----------------------------------------
#!/usr/bin/sh

typeset U=""
typeset L=""
typeset -i STAT=0

logins | awk '{print $1}' | \
sort | while read U
do
L=$(/usr/lbin/getprpw -r -m lockout ${U})
STAT=${?}
if [[ ${STAT} -eq 0 ]]
then
echo "${L}" | grep -E -q -e '^1' -e '^.1' -e '^..1'
STAT=${?}
if [[ ${STAT} -eq 0 ]]
then
echo "User ${U} expired"
fi
else
echo "getprpw failed for user ${U}; status ${STAT}." >&2
fi
done