Account locking

[John Ivy]

What is the quickest way to findout what computer or user is locking an account.

[Steven E. Protter]

Shalom,

passwd -sa

take a look at /var/adm/syslog/syslog.log

You will see the bad login attempts.

lastb

Also lists bad login attempts.

SEP

[Doug O'Leary]

Hey

Unfortunately, there is no quick way as there's multiple ways of locking an account:

Is the system trusted? If so, run "modprpw -m lockout ${user}". See the man page for the resulting code. Chances are it'll be bad passwords, but it's good to be sure.

Check syslog.log for remsh/ssh accesses. If you're using the software.hp.com version of tcpd, check mail log for accesses via ftp or telnet.

If you're using sudo, check the sudo log for people accessing root and what they were doing.

Some information from at least one of those sources should give you the next step in your investigation.

Doug

[John Ivy]

Thanks for the information I am slowly getting there