Is there a command I can use to get the users that have not logged on for more than n days ?

[Luis Toro]

Hello,

I did a man on getprpw, and I'm trying to see if there is a simpler method of obtaining a report on users that have not logged into a server for over 30 days. Seems if I use getprpw, I would have to do some scripting to get this info from the slogint.

Thank you

[Ken Penland_1]

Not that I know of...here is a snippet from a script I have that reports a bunch of stuff...this should report what you are looking for:

#!/usr/local/bin/perl

format LIFETIME =
User @<<<<<<< (@|||||||||||||||||||) has not changed their password since @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$username, $realname, $laston
.

print "\n", "_" x 75, "\n";
$counter = 0;
print "EXPIRED ACCOUNTS - Accounts currently locked due to Password Lifetime Exceeded\n\n";

@passwd = `cat /etc/passwd`;
foreach $line(@passwd)
{
($username,$p,$uid,$gid,$rlname,@rest) = split(/\:/,$line);
($realname,@rest) = split(/\,/,$rlname);
if ($uid < 100) { next; }
$checkit = `/usr/lbin/getprpw -m lockout $username`;
$checkit =~ s/\s+$//;
($junk,$reason) = split(/\=/,$checkit);
if ($reason ne "1000000") { next; }
$checkit = `/usr/lbin/getprpw -m spwchg $username`;
$checkit =~ s/\s+$//;
($junk,$laston) = split(/\=/,$checkit);
$counter++;
$~ = "LIFETIME";
write;
}

[Paul Sperry]

lastlogin Invoked by runacct to update /var/adm/acct/sum/loginlog
which shows the last date on which each user logged in
(see runacct(1M)).

[PIYUSH D. PATEL]

Hi,

You can use 'find' to go throught the $HOME directories of the users and look at the last access date from their '.profile'.

You can also check the /var/adm/wtmp file and use 'last' and compare its contents to /etc/passwd. Check for users who do *not* appear in 'wtmp'.

HTH,
Piyush

[Helen French]

Couple of solutions here:

http://forums.itrc.hp.com/cm/QuestionAnswer/0,,0x4c677bb04b5cd611abdb0090277a778c,00.html

[Caesar_3]

Hello!

If it's about login of user on some machine
so use finger

Caesar

[Jim Mallett]

Another thing to think about is that you can automate the process if you are using a Trusted System. Plus that adds other safeguards. The above ideas will work great though. Just a thought.

Jim

[twang]

Hi,
I think you may use "last" to retrieve the users who have logged in the past 30 days into a tmp file, and then compare this file with the users list.

[Sridhar Bhaskarla]

Hi,

I just posted this message in another thread. One pain is that you have maintain your wtmp file for atleast 'n' days to get accurate information.

//
There isn't a simple way of finding this out. If you want to find this out, the best way is to use last command. However, this pulls out the information from wtmp. So, if you trimmed it anywhere in the last three months, then you won't get the information. So, you will have to plan. Either keep the wtmp file for 3 months or regularly recycle (using /usr/sbin/acct/fwtmp
) but keep the old files somewhere.

Then it is just a question of writing a script that can take care of it.

last -R > last.log

(Edit this and remove standard logins like root, bin, sys etc., or you can put a grep -v in the above. Delete the entries that are older than n days)

for LOGIN in $(awk '{FS=":";print $1}' /etc/passwd)
do
grep -q $LOGIN last.log
if [ $? != 0 ]
then
echo $LOGIN >> nologin.out
fi
done

if [ $(wc -l nologin.out|awk '{print $1}') -eq 0 ]
then
echo |mailx -s "No LOGINS" your_id@yourdomain.com
else
mailx -s "NO LOGIN REPORT" yourid@yourdomain.com < nologin.out
fi

//

-Sri

[Luis Toro]

Thanks for all your input.
I believe Sri and Shiju had a better understanding of what I was looking for, although it looks like it will have to be scripted.

wtmp goes back well beyond 3 months and it is a trusted system with the "disable inactive" accounts set to 90 days. I can't use the ".profile" idea, since the home directory is shared for all end users. My problem is that
someone wants a report of users that have not logged on in 30 days. So they may very well be in wtmp (goes back a year), and if they've logged on within the past 90 days, they'll still be enabled.
A colleague has recommended trying a version of
the 'date' command (from the HP Porting Center) to see if that allows me to do more flexible data comparisons against the wtmp file.

Thanks

[Paula J Frazer-Campbell]

Hi

This should help:-


------------------CUT HERE-------------------
#!/bin/sh
#####################################
# Last login checker
#####################################
# PJFC 04-2002
#####################################
# Get logname from passwd and push to file.
cat /etc/passwd | sed 's/:/ /' | awk '{print $1}' | sed 's/^/ /' | sed 's/ /last /' >/tmp/passlast.one
#####################################
# Get file and create an "Echo command file"
cat /tmp/passlast.one | sed 's/last/echo/'>/tmp/passlast.two
#####################################
# Paste files together
paste /tmp/passlast.two /tmp/passlast.one >/tmp/passlast.three
#####################################
# Seperate the commands and just look at last login
cat /tmp/passlast.three | sed 's/last/; last -1 /' >/tmp/passlast.go
#####################################
# Tidy up
rm /tmp/passlast.one
rm /tmp/passlast.two
rm /tmp/passlast.three
#####################################
# Make created file executable
chmod 755 /tmp/passlast.go
#####################################
# Run the created program
/tmp/passlast.go >/tmp/passlast.results
#####################################
# Send out result
mailx -s " Last logins" root #####################################
# Tidy up
rm /tmp/passlast.go
# Hash out the next line to keet results in /tmp
rm /tmp/passlast.results
#####################################
# ALL DONE

----------------cut here---------------------


Paula

[Pepe Jimenez Muñoz · Accepted solution]

Hi Luis, I have this script to tell me the time since each user login in the system.

The script writes username|days_last_login in /etc/pepe file.

# Este script genera un listado en /etc/pepe
# que contiene cada usuario y el tiempo que lleva
# sin hacer login al sistema.

> /etc/pepe
chmod 644 /etc/pepe

ahora=`/usr/contrib/bin/perl -e 'printf "%d\n",time()'`

for i in `cat /etc/passwd | cut -d":" -f1`
do

letra=`echo $i|cut -c1`
#echo $i $letra
ultimologin=`cat /tcb/files/auth/$letra/$i | awk -F "u_suclog#" ' {print $2}' | cut -d":" -f1 |
grep -v ^$`
# echo $ultimologin
let "dias=(( $ahora - $ultimologin ) / 86400) "

echo $i"|"$dias >> /etc/pepe
# echo $i"|"$dias

done

I hope this help you.

VIVA EL BETIS.

(Betis is the best football team in the world)

[David_246]

Hi Ken,

I'dd love to reply this one to you directly, but not possible unfortunetly.
I made some addaptions to your script. (especialy the value of $reason !!)

I realy like the script, it learned me a lot.

Regs David

#--------------------------------
#!/usr/local/bin/perl

format LIFETIME =
User @<<<<<<< (@|||||||||||||||||||) has not changed their password since @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$username, $realname, $laston
.

print "\n", "_" x 75, "\n";
print "EXPIRED ACCOUNTS - Accounts currently locked due to Password Lifetime Exceeded\n\n";

open(FH, "< /etc/passwd");
@passwd = ;
close(FH);

foreach $line(@passwd) {
($username,$uid,$rlname) = (split /\:/, $line)[0,2,4];
next if ( $uid < 100 );

$checkit = `/usr/lbin/getprpw -m lockout $username`;
$checkit =~ s/\s+$//;
$reason = (split /\=/, $checkit)[1];
next if ($reason ne "0000001");

$checkit = `/usr/lbin/getprpw -m spwchg $username`;
$checkit =~ s/\s+$//;
$laston = (split /\=/, $checkit)[1];
$laston = "never" if ( $laston eq "-1" );
$realname = (split /\,/, $rlname)[0];

$~ = "LIFETIME";
write;
}

[John Meissner]

I wrote this script so that you can see who has not logged in in the past 60 days.

[Luis Toro]

Thanks.

I think I found what I need using a combination
of Ken and Pepe's scripts, with some adjustments. [Ken, unforntunately I can't re-assign points, and I didn't think it proper to
assign higher points to Dave, who referenced your script.].