User monitor report

[Joseph Bague]

Hi to all guru's and master,

Do you have a sample script that monitor the changes on user like account lock out, new user has been add etc,

Thanks in advance
Joseph

[Michael Tully]

I don't actually have one, but have a look in the sysadmin script postings from these links. You might something of use there.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x026250011d20d6118ff40090279cd0f9,00.html
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x836cc1c4ceddd61190050090279cd0f9,00.html
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xf0fc5dc05a7ad711abdc0090277a778c,00.html

[Con O'Kelly · Accepted solution]

Hi Joesph

Sorry I don't have any scripts to do this. You may have to write your own.

I've attached an old security script that you might be able to pull a few ideas from eg failed logins, failed su to root etc.

For trusted systems look at /usr/lbin/getprpw command.
-> look for lockout=0000000. If not then account is locked.

Maybe use a diff command to check for any changes to /etc/passwd file.


Cheers
Con

[Steven E. Protter]

If your mystem is trusted, you may be able to fine tune the audit logs to get what you want.

passwd -sa reports some data on the user, but doesn't report new ones.

You could scan the root .sh_history file for the useradd commmand to get users.

The information is out there, you need to work a bit to get it.

SEP