I need help finding a way to search for disabled account

[skt_skt]

I need help finding a way to search for disabled account in linux

[skt_skt]

disabled/deactivated..

[Patrick Wallek]

Run a 'passwd -Sa' (that is a capital S and a lowercase a) and look for accounts that have an 'LK' in the 2nd column. Those accounts are locked.

[OldSchool]

Patrick...you missed the "in linux" part
he's got 2 posts in the Linux forums as well.

[Patrick Wallek]

Umm...No I didn't miss the "Linux" part.

I ran the "passwd -Sa" on my SuSE Linux Enterprise Server 10 machine and it works great.

Now since he didn't mention WHICH LINUX, I can't be responsible if what works on my SLES box doesn't work on his "other Linux flavor" box.

[skt_skt]

let me be clear; i am looking for an answer in HP-UX since it is an HP-UX forum. I have a separate question in linux.(i forgot to remove "linux" filed while posting the similar question in HP-UX forum).

[/root] /usr/lbin/getprpw kumarts
uid=19806, bootpw=NO, audid=2351, audflg=1, mintm=-1, maxpwln=-1, exptm=-1, lftm=-1, spwchg=Mon Oct 15 15:17:03 2007, upwchg=Fri Sep 7 15:53:26 2007, acctexp=-1, llog=-1, expwarn=-1, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Fri Oct 26 19:18:49 2007, ulogint=Fri Oct 26 09:05:52 2007, sloginy=tty, culogin=-1, uloginy=-1, umaxlntr=-1, alock=NO, lockout=0000000

the value lockout=0000000 tells me the account is NOT locked.

May be i am confused with account deactivated and locked. is there a diffrence between deactivated and locked state.

My intention is to delete the deactivated accounts. But i DONT want the accounts to be deleted whihc are locked (example due to 5 login failures; a needed account can be in locked state at that point of time).

So i want to identify only deactivated accounts?

here my concern i see some of the accounts are in deactivated state but they are still in use/can be used.This i observed for set of ftp accounts and thier properties are below.(Please note that this accounts was recreated recently as the account was deleted assuming not in use/deactivated; so you can see new dates for spwchg,slogint now)

/usr/lbin/getprpw amsboa01
uid=154, bootpw=NO, audid=2740, audflg=1, mintm=0, maxpwln=-1, exptm=0, lftm=0, spwchg=Thu Oct 25 09:05:39 2007, upwchg=-1, acctexp=-1, llog=0, expwarn=0, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Thu Oct 25 08:43:26 2007, ulogint=-1, sloginy=-1, culogin=-1, uloginy=-1, umaxlntr=-1, alock=NO, lockout=0000000


did i get that correct(accounts are in deactivated state but they are still in use)?if that is correct/incorrect , how we can explain that scenario?

[Patrick Wallek]

If you are on HP-UX 11.11 or higher then do a 'man getprpw' and look for the "lockout" section. There you will see what each position of the 'lockout=0000000' means. Each position mean a different thing.

The bottom line though is if ANY position has a '1' in it, then the user can't login.

[Sachin Rajput]

WWhy don't you check in /etc/passwd file.The entries having * for there passwd field are the disabled ones.

[skt_skt]

i know about this 7 bits.

REASON[1]="past password lifetime"
REASON[2]="past last login time"
REASON[3]="past absolute account lifetime"
REASON[4]="exceeding unsuccessful login attempts"
REASON[5]="password required and a null password"
REASON[6]="admin lock"
REASON[7]="password is a *"

So did u mean if the account is locked(one of the bits is one) the account is in "deactivated" state?

[Patrick Wallek]

You said: "So did u mean if the account is locked(one of the bits is one) the account is in "deactivated" state?"

If there is a '1' in ANY position in the lockout string, then the user CANNOT login. Whether you call that locked, disabled or deactivated is entirely up to you.

[Patrick Wallek]

Note to Sachin Rajput:

You said: " WWhy don't you check in /etc/passwd file.The entries having * for there passwd field are the disabled ones."

Since Santhosh asked about the output of the getprpw command, specifically the "lockout" value, that indicated that this system is set up as a TRUSTED system. If you review how a trusted system works, you will discover that ALL account have a '*' in the passwd field in the /etc/passwd file. That is because the password is NOT actually stored there. The passwords are stored in the /tcb/files/auth/* directory structure.

In this case the '*' does NOT indicate the account is disabled.

[Tim Nelson]

awk -F: '{print $1}|while read list
do
/usr/lbin/getprpw -m lockout $list|awk -F= '$2 != "0000000" {print "DEACTIVATED"}'
done

Add your own tweaks as needed.

[Tim Nelson]

ooops.

awk -F: '{print $1} /etc/passwd|while read list
do
/usr/lbin/getprpw -m lockout $list|awk -F= '$2 != "0000000" {print "DEACTIVATED"}'
done

[skt_skt]

closig with the current informations. Thanks to all.

[skt_skt]

closig with the current informations. Thanks to all.