user account monitoring

[Jeff Hoevenaar_1]

Is there a easy way to monitor for such things as:
all active accounts
all accounts which have been inactive for more than 14 days
a list of accounts created and deleted in a specified time period

I would like to be able to create a report each month.

[Evan Day_1]

The last(1) command will display who has logged in recently as recorded in
/var/adm/wtmp. You might be able to use this information to generate some kind
of report, just parse the /etc/passwd file and run last on each user id.

Even better, though, is the TCB on a trusted-OS system. /tcb/files/auth
contains a file for every user, indicating the last time the user logged in,
failed to login, changed password, failed to change password, etc. I can't
imagine it would be too hard to write a script to go through all of these files
and generate a report.

You might also look into auditing (also a function of a trusted OS) for more
detailed monitoring.

If you aren't using a trusted OS, you can convert to a trusted OS in SAM (look
under auditing). You may or may not want to do this though. I'd recommend a
little research before making any drastic changes.

[Russell O'neal]

If wtmp does not have good user info or has been trimmed, you can also check
for the date stamp of each user's shell history file in your script.

[Evan Day_1]

Here is source code to a short little program that will convert any number
passed to it into a date. The number is taken to be the number of seconds
since the Epoch (see ctime(3C) for more information).

If there's a shell built-in or utility standard w/ HP-UX that does this, I'd
love to hear about it.

It can be used to convert the number in the TCB to a real date:

#include
#include

int main(argc, argv)
int argc;
char **argv;
{
time_t time = atoi(argv[1]);
printf("%s\n", ctime(&time));
}

(in K&R since the basic HP compiler doesn't do ANSI)

$ ctime 0
Wed Dec 31 16:00:00 1969

$ ctime 955000000
Wed Apr 5 22:46:40 2000