Inactive accounts

[Joan Blais]

My environment consists of both 11.0 and 11.i systems. In an "untrusted" environment, how can I track inactive user accounts?
Thanks,
Joan

[Rodney Hills]

I have a perl script that reads the output of "last" and reads in /etc/passwd. It then dumps out a report of all the accounts and the last logins.

-- Rod Hills

[Robert-Jan Goossens_1 · Accepted solution]

Hi Joan,

Check Matthew F. Carr answer in below thread.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=150881

Regards,
Robert-Jan

[Rodney Hills]

Here is the script if you are interested-

#!/usr/local/bin/perl
# Show last logins for every user in /etc/passwd
#
open(LASTLOGIN,"last|") || die "Can not run 'last' command\n";
while () {
next if $_ eq "";
if (/^wtmp begin/) {$begin=$_ ; next};
($name,$tty,$date)=/(\S+)\s+(\S+)\s+(\S+\s+\S+\s+\S+)/;
$user{$name}=$date unless $user{$name};
}
print $begin;
close(LASTLOGIN);
open(PASSWD,"/etc/passwd") || die "Can not open '/etc/passwd'\n";
while () {
next if /^\+/;
($name,$rest)=split(":");
$user{$name}="**NOT USED**" unless $user{$name};
}
foreach $name (sort keys(%user)) {
printf "%-10s %s\n",$name,$user{$name};
}

[Joan Blais]

Thank you for the scripts.
Joan