Locking User - Effect

[joe_91]

Team:

What would be the best way to lock a user and how?(both /etc/passwd and NIS) Also two more questions..

1. If the root su's to the locked user-id will it succeed?

2. will the locked users' cron job still run?

Thanks

Joe.

[Mel Burslan]

to lock a user

on a trusted system
/usr/lbin/modprpw -m alock=YES username

on an untrusted system
passwd -l username

1. yes, root will be able to su to a locked out account

2. no, a locked out user's cron jobs will not run

[Ranjith_5]

Hi Joe,

On a trusted system, to lock a user ID, issue the command
----------------------------------------------------------------

#/usr/lbin/modprpw -m alock=YES
======================================================

To unlock the user ID which is locked.
------------------------------------------

#/usr/lbin/modprpw -k


su can be done by root eventhough the account is locked out OR password is expired.

cronjob wont run for those users whose account is locked.


Regards,
Syam

[Alan Meyer_4]

I just ran some tests on this and a locked user's cron jobs will still run.

[Ranjith_5]

Alan,

are u sure on this? I havent seen this..can u confirm


Regards,
Syam

[Alan Meyer_4 · Accepted solution]

I just reproduced it again. Both in a NIS and in a local environment. Think about, locking the uid just locks the password on the account. By that, it prevents access to the account from the outside.

root can still su to the account and run programs and own processes, so the account can still own and run processes, you just can't log in to it.

The crontab file for the account still exists so cron runs the jobs that exist in the crontab file. Cron does not know, or care if the password is active or not. It just cares that the uid is valid enough to own the process to run the job.

[joe_91]

wonderful..so the root can su and the cronjobs will run..to summarize..

Thanks

Joe.

[Alan Meyer_4]

That's what my tests have shown.

[Ranjith_5]

Good finding...Joe kindly assign assign points to Alan.


Regards,
Syam

[joe_91]

Thanks folks. yeah good finding..

Joe

[Bill Hassell]

The reason that cron still runs on a locked user account is that cron does not login. It runs the jobs on behalf of the owner but does not login. That's why there is a minimal environemnt (no profiles are run unles part of the actual job).

[joe_91]

Thanks Bill..

Joe