User aging..

[Roy Colica]

All,
do you think is possible to match this requirement? If a user remains unused for 60 consecutive days it must be disabled. If no authorised request for reinstatement is received within a further 30 consecutive days the userid must be deleted.
I think the first can be done with HP-UX trusted, the second? Do you think I've to implement something or could be free?
Can you please help? Thanks.
Roy

[RAC_1]

Not possible without some scripting. Even the first requirement will also require some scripts to be run and and decide user expiry and disable it. Take it further and delete it as per requirement.

[Muthukumar_5 · Accepted solution]

Yes. First requirement you have to go with trusted system (If you want to have normal hp-ux manner).

Two more ways to achive first requirement:

i) last | grep 'username'
gives last successful login. Calculate day difference and remove the user.

ii) You can play with /etc/profile file to achive this as,

# mkdir /var/users/
# Edit /etc/profile as,
echo "`date +'%d %m %y'`" > /var/users/${LOGNAME}

You can compare the contents in /var/users with current date difference and remove the user account with userdel.

Second Requirement:

Use last and lastb command to achive this.

# last | grep 'username'
# lastb | grep 'username'

get the time stamp and produce the latest one in both. See the time stamp difference with current date and remove user id.

hth.

[Muthukumar_5]

Refer this thread:

http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=855955

To get a date difference.

DAY1=$(cat /var/users/${LOGNAME}
DAY2=$(date +'%d/%m/%y')
typeset -i DIFF=$(( $(caljd.sh ${DT2} - $(caljd.sh ${DT1}) ))
if [[ ${DIFF} -gt 60 ]]
then
userdel
fi

hth.

[Steven E. Protter]

Shalom Roy,

Its possible and the best way to go is trusted system. This conversion makes teh 60 day rule easy to enforce.

The second 30 day until delete is probably better done by policy. When an account becomes disabled, its status is changed and this can be accounted for.

You can build a little report with passwd -sa and probably get your user list.

Take a look at that report output and see if it might be helpful.

Surely this could be done for free, because the best solution is a scripted solution.

SEP

[Roy Colica]

Thanks.