Gathering info from trusted system files.

[Jeffrey Davis_1]

Hi all,
Does anybody have any scripts that are able to read the trusted system database entries (/tcs/files/auth/[a-z]/{username} files to check for things like:
password lifetime expiration hit,
password last changed when,
last login, and the like.
Some of the entries in these files are useable, but some good ones are based on 'stime'. My systems are HP-9000 UX 10.20 & 11.00.
Any ideas on how to figure these out?
Thanks in advance,

[Uday_S_Ankolekar]

Hi,

If you turn on auditing you may get all these information
the file you would find in
/.secure/etc/audfile1

Here is the procedure to enable auditing with
SAM
http://us-support.external.hp.com/cki/bin/doc.pl/sid=e6ac474f199f0690ea/screen=ckiSearchResults?mode=id&searchString=NTFAQ184

-USA..

[Roger Baptiste · Accepted solution]

Hi,

You can use the /usr/lbin/getprpw command to get the same info. Run it in a loop for all userids and gather the output.

eg:/usr/lbin/getprpw ftp
uid=500, bootpw=NO, audid=65, audflg=1, mintm=-1, maxpwln=-1, exptm=-1, lftm=-1, spwchg=-1, upwchg=-1, acctexp=-1, llog=-1, expwarn=-1, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Tue Dec 11 12:12:13 2001, ulogint=Mon Dec 10 12:32:42 2001, sloginy=-1, culogin=3, uloginy=-1, umaxlntr=-1, alock=NO, lockout=0000001

HTH
raj

[Deshpande Prashant]

HI
If you enable auditing in system, you can use "audisp" command to generate reports you need. Check man audisp.

Thanks.
Prashant.

[Michael Tully]

Hi,

'getprpw' is most likely what your looking for. There is a copy of the man page from this link.

HTH
-Michael

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xebf46c96588ad4118fef0090279cd0f9,00.html