Locked Account notification

[Belinda Dermody]

I am running a trusted system on a K200 box with HP-UX 10.20. Is there anyway that the system can send a mail msg to root when a user disables his account after 3 failed login attempts.

[Wodisch]

Hello James,

AFAIK no way - at least no "nice" way of doing it.
The crude way could be like scanning all the users's
file below "/tcb/files/auth/?/" for the flag for being
locked and being "newer" than a flag-file:

find /tcb/files/auth/? -newer /tcb/lasttime -print |
while read name; do
if grep "u_lock..." >/dev/null
then echo $name |mailx -slocked-user root
fi
done
touch /tcb/lasttime

and schedule that via "cron" say, every half hour, or so.
I am just not certain about the "u_lock..." part, check
with a locked user on your system to get that right.

HTH,
Wodisch

[Belinda Dermody]

Additonal Info. I was afraid that would be the answer. So I modified the support user menu system that I wrote (SAM is to darn slow) and by using the getprpw command and thanks to dutchworks who provided the man pages. I was able to add another option to display user information for disable accounts on a trusted system.

[Dieter Degrendele_1]

Hi,

I do following:

Since all suspended users generate a message in /var/adm/syslog/syslog.log I do a tail -f of this file with a grep on "suspended for password violations". You can redirect the output to sendmail. Put all of this in the cron and here you are, the soup is ready!

Rgds,
DD

[Belinda Dermody]

Since all suspended users generate a message in
/var/adm/syslog/syslog.log I do a tail -f of this file with a grep
on "suspended for password violations". You can redirect the
output to sendmail. Put all of this in the cron and here you
are, the soup is ready!

Rgds,
DD
In response to this reply. I do not know what you might have running to generate the message password violations to the syslog. I do not generate that msg when a user locks him/her out.