restrict inactive user accounts

[unixadmin_1]

Inactive user accounts were still present on the system. Eight hundred and two (37%) users had not logged on for 60 days, while 353 (13%) users had not logged on for 90 days. Inactive accounts are attractive targets that are often exploited to gain unauthorised access because the authorised users of such accounts are unlikely to notice someone breaking into and using them. Also, by using an existing account, the unauthorised user is less likely to draw the attention of the system administrator than if a new account is opened.

[Ganesan R]

Hi,

You can deactivate the inactive accounts if the system is trusted.

[yulianto piyut]

u can restrict by editing /etc/passwd file, edit the shell of user to /usr/bin/false or /bin/false. go to cissecurity to get manual book.

[Rita C Workman]

Well you seem to know who these folks are....so why not output their login-ids to a file, then run them through a simple loop to lock those inactive accounts....

for a `cat /inactive-login_ids.lis`
do
/usr/bin/passwd -l $a
done

You can dress it up....but it gives you an idea.

Rgrds,
Rita

[change owners]

as i am new to hpux, can you please send me complete code where i can restrict these passwords..Thank you

[prasadb]

hello unixadmin,

" for a `cat /inactive-login_ids.lis`
do
/usr/bin/passwd -l $a
done "

the point of Rita is only that if you already know the user accounts that are inactive for many days, make a list and then use

for a cat
do
/usr/bin/passwd -l $a
done

Best Regards,
prasad

[Dennis Handly]

>prasadb: make a list and then use

A better form without evil cat would be:
for a in $(< list-you-created); do
/usr/bin/passwd -l $a
done

[unixadmin_1]

Please send me step by step process from the begining and please elaborate this issue ..I am beginer to unix environment..i got job as a fresher ...i couldnt understand one thing most of the answers i observed in HP forums are incomplete..if you dont mind please let me know how to execute this script and under what directory the code is executed..Please let me know the step by step process ...I just know how to login...and fes commands..thats it Thank you

[Peter Nikitka]

Hi "unixadmin",

some thoughts to your question and answers:
Do you have a list of these user accounts?
If not: get it.

Which format does this list have?
Create a file named 'inactive.lis' out of this list, having one user account in one line, if the list has not already this format.

Now copy or type the three lines of Dennis' answer in the command line:
for a in $(do /usr/bin/passwd -l $a
done

mfG Peter

PS: Do you know how to create a file?

[Patrick Wallek]

>>.I just know how to login

Then what are you doing in a System Administrator role? It sounds like you are extremely underqualified for the job.