User Account Management

[B.Mahendra Kumar_2]

As we are having user account auditing, Is there any script available to check the following on HP-UX

User Account = Deactivated
User Account = Never logged in for more than 45 days
User Account = Never logged into the system
User Account = Passwd expired

Where it has to grep $1 and $5 from the passwd file

Thanks in Advance

Regards
Mahendra Kumar

[Maxim Yakimenko]

Hi,

look this:

man last
man shadow
man passwd

This should help to find the right answer.

[Rasheed Tamton]

If you do not have auditing enabled, then this might help for a quick solution.

passwd -sa|grep LK (locked user accounts)

The format of the display will be:

name status mm/dd/yy min max warn

where status PS=passworded; LK=locked; and NP=no password.
or, if password aging information is not present
name status



man passwd
man security
man last

--This will get the last login data for all the users (if you add "grep -Ei 'apr|mar'" with the third line you can get for Mar/Apr login info - though it is not that sophisticated)

for i in `awk -F: '{print $1}' /etc/passwd`
do
last -1 $i|grep -vE 'wtmp|^ *$'
done


for i in `awk -F: '{print $1}' /etc/passwd`
do
last -1 $i|grep -vE 'wtmp|^ *$'|grep -Ei 'apr|mar'
done

The above depends on the info contains on /var/adm/wtmp file. If it is regularly trimmed then it will have only the info from that date.

Regards,
Rasheed Tamton.

[Ananda Matthur]

Hi Mahendra,
Which version of HPUX are you using? won't SAM help here? If you are using 11.23 0512 onwards or 11.31, you can use the tool ugweb in SMH which gives all this data in a table.

[A. Clay Stephenson]

If you are running a trusted system then you can execute /usr/lbin/getprpw and examine the lockout field. This is a 7 character string which consists of 0's and 1's. A 1 indicates a locked account and its position indicates the reason. Man getprpw for details (and look for the "lockout" description).

This should be very close:

-----------------------------------------
#!/usr/bin/sh

typeset -i STAT=0
typeset U=""
typeset L=""
logins -t | awk '{print $1}' | while read U
do
echo "${U}\t\c"
L=$(/usr/lbin/getprpw -r -m lockout ${U} 2>/dev/null)
STAT=${?}
if [[ $STAT -eq 0 ]]
then
echo "${L}\c"
else
echo "???????\c"
fi
echo
done
exit ${STAT}
--------------------------------------------
The logins command is used to get the users and then each user is sent to getprpw. I'll leave the translation of the lockout string as an exercise. If you are not running a trusted system then only a small subset of the data you are seeking is available.

[B.Mahendra Kumar_2]

Maxim

Thanks for man pages, But i am running short of time to do scripting, Hence i was expecting some ready made scripts are in place in the ITRC.
============================================
Rasheed

passwd -sa |grep LK

it gives only the user ID and the status but there is no format display as you have stated.

Regarding the for loop cases, I get only for the users in wtmp. We trim this file every one month, Any how i will try to put in the file from backup and test for more number of days, But it does not show if the user ID is not logged into the server.

============================================

Ananda

We have OS running on 11.00 and 11i and by the way where i can get this tool, Is it a freeware i can download.
============================================

Clay

Thanks for the script but still i can view the LK, But i want to see all the users in the server, If i can get like the format i asked in the question it will be much appriciated.

============================================

I have been tied up other projects and as well as for auditing, Hence i am looking for a script on the format i was asked. Anyhow thanks for the information provided. But still if any other scripts are avaliable on this user account management please provide me, Thanks in advance.

Regards
Mahendra Kumar

[A. Clay Stephenson]

Sorry, I don't help those who are lazy. Your only task left is to decode the 7 character string of 1's and 0's --- and any child on the streets of Starkville could do that.

[B.Mahendra Kumar_2]

Thanks to clay,rasheed,ananda and maxim. Taken from some tips from your end i was able to manage to take the reports.

Regards
Mahendra kumar

[B.Mahendra Kumar_2]

from the tips provided i was able to manage to take the reports for the user account management.