Determining last user logon

[Clifton Smith]

I administer a trusted system (all password entries in /tcb/files/auth/*), and need some way to determine the last logon of all users in /etc/passwd for a particular system.

Is there any way to use the u_suclog field in the tcb encrypted file or ANY other way to determine for each user in /etc/passwd when their last logon was? We are going to use this for clean up purposes on the system..... Any assistance is GREATLY appreciated..

[Slawomir Gora]

Hi,

you can use command for each user:

last user_name | head -n1

[Rodney Hills]

Would the "last" command work for you?

I've merged the output of "last" with "/etc/passwd" via a perl program and have generated such lists for myself.

-- Rod Hills

[Steven E. Protter]

IF the user logged on since the last time the /var/adm/wtmp file was cleared.

last

will show it.

If not, passwd -sa might provide some useful data or some other variation, though this may only show the last time they changed their password. That isn't useless, may be helpful.

SEP

[Geoff Wild]

last userid

last userid |head -1

Rgds...Geoff

[Rodney Hills · Accepted solution]

Here is the perl program I used-

#!/usr/local/bin/perl
# Show last logins for every user in /etc/passwd
#
open(LASTLOGIN,"last|") || die "Can not run 'last' command\n";
while () {
next if $_ eq "";
if (/^wtmp begin/) {$begin=$_ ; next};
($name,$tty,$date)=/(\S+)\s+(\S+)\s+(\S+\s+\S+\s+\S+)/;
$user{$name}=$date unless $user{$name};
}
print $begin;
close(LASTLOGIN);
open(PASSWD,"/etc/passwd") || die "Can not open '/etc/passwd'\n";
while () {
next if /^\+/;
($name,$rest)=split(":");
$user{$name}="**NOT USED**" unless $user{$name};
}
foreach $name (sort keys(%user)) {
printf "%-10s %s\n",$name,$user{$name};
}


HTH

-- Rod Hills

[Clifton Smith]

Rod - Thanks !! This is just what I needed..... I would like to press my luck to ask one more thing, however. I am not very familiar with Perl, and I would like to know how to narrow down the search in /etc/passwd to users with a specific word in their logon path.. For instance, in the POSIX world, it would look something like "grep (string) /etc/passwd". I am unfamiliar with how to insert this into the Perl script that you have submitted. Are you, or anyone in this thread, familiar enough with Perl to add some insight?

Thanks

[Rodney Hills]

If you look at the line

next if /^\+/;

This statement skips those lines that begin with "+". What ever regular expression can be used. Example-

To ignore users who are using ksh.
next if /bin\/ksh/;

You could also replace the follwing split statement with-
($user,$pswd,$uid,$gid,$comment,$path,$shell)=split(":",$_);

Then do comparisons on the a field-
next unless $comment=~/test/;

Would only keep entries with "test" in the comment field (note "unless" clause).

Perl is the swiss army knife for system admins.

HTH

-- Rod Hills

[Patrick Wallek]

An easier, and quicker way to get the last login is:

# /usr/lbin/getprpw -m ulogint user_id

[Slawomir Gora]

Hi,

you can use shell script:


#!/bin/sh

for user in `cat /etc/passwd | awk -F':' '{print $1}'`
do
RES=`last $user | head -n1`
[ "$RES" = "" ] || echo $RES
done

[doug hosking]

Patrick, did you mean slogint instead of ulogint? (successful vs. unsuccessful)