verify an User

[alessandro_37]

dear All,
i have an user on my System HP-UX 11.00 called guest.
I wont know when it is have been created and by who?

grep guest /etc/passwd

guest:*:103:20:Guest login:/home/guest:/sbin/sh

How can I verify and freeze/or blocked this user.
(I wont not cancell the user but only block it)

Thanks Alex

[Jose Mosquera]

Hi,

Check ownership and timestamp of the user home directory by the command:
# ls -l /home/guest

Don't worry about this user. The "*" character in the 2nd field of /etc/passwd file indicates you that this user is locked.

For extra info:
# man passwd

Rgds.

[Mark Grant · Accepted solution]

Setting a shell of "/usr/bin/false" is probably the best way of ensuring nobody can log in as the user.

running "last guest" will give you a list of all the times someone has logged in as that user.

[Chris Wilshaw]

The * in /etc/passwd does not always mean that the account is locked. If the system is trusted, this information is held in files under /tcb/files/auth

The simplest way to lock the account is to use

passwd -l guest

(that's a lower case L). This will prevent login, while keeping the ID and all associated files in place.

[Stanimir]

This user is has already been desactivated.
The simpliest way to desactivated the
user is using SAM, menu: Users/Groups.
You can choise the user and make desactivation :).

[Jose Mosquera]

Ooops..!

Alessandro if your system is in trusted mode pls consider the Chris note.

Rgds.

[Anupam Anshu_1]

To find which user was created when, you will need to switch on auditing (for how to switch on autditing "man 4 audit"). You can switch on auditing through SAM tool too.

Other way of finding out when and how user was created is not known to me. One way could be archiving HISTFILE of the root user :-).

Regards,

Anshu

[Joseph Loo]

hi,

for trusted system, the second segment is * for all accounts in the file /etc/passwd.

for non-trusted system, the second segment is * for account that r disabled.

to check when the last time guest account is use:

# last -R|grep guest|head

regards.