[Scottish] User account disabling

[Paxton, Darren]

Sorry for top-posting - using crappy outlook


Colin

It does help, thanks, but isn't the default for lastlog only back to about 30 days or so? I'm guessing I'd have to modify this across all the systems to hold more than this. I think this will be required anyway no matter what I choose, though.

Thanks

Darren




Paxton, Darren wrote:
> Hi All,
>
> Having one of those moments where no matter where I'm searching, can't seem to find what I'm actually looking for.
>
> Wondering how any of you are currently handling user account expiry if an account lies idle for a defined amount of time.
>
> I've seen perl scripts listed in some places, but I'm trying to see if I can use whatever native tools are already in place to identify when the user last logged in (this is on RHEL systems) and then work out if this is greater than the threshold of 90 days.
>
> At this point, we're not actually going to disable those accounts, just looking for a way to identify them so that systems can be flagged as requiring attention. (hopefully this will all help contribute to the argument for a centralised authentication mechanism).
>
> Systems are all RHEL so any advice anyone's got on this platform would be greatly appreciated.

`lastlog` will probably be your first port of call:

# lastlog
Username         Port     From             Latest
root             tty1                      Sat Feb 28 14:01:43 +0000 2009
bin                                        **Never logged in**
daemon                                     **Never logged in**
adm                                        **Never logged in**
lp                                         **Never logged in**
sync                                       **Never logged in**
shutdown                                   **Never logged in**

~snip~

You can also specify a range of UID's
# lastlog -u 1000-2000

This might be more useful for parsing - you might not want to disable
some accounts.

> Password expiry is also being enabled therefore was wondering if this could be centred around that as a way of doing the calculation.
>
> Thanks
>
> Darren


HTH

-Colin

_______________________________________________
Scottish mailing list
Scottish at mailman.lug.org.uk
https://mailman.lug.org.uk/mailman/listinfo/scottish

This e-mail and any attachments may be confidential or legally privileged.If you received this message in error or are not the intended recipient, you should destroy the email message and any attachments or copies, and you are prohibited from retaining, distributing, disclosing or using any information contained herein. Please inform us of the erroneous delivery by return e-mail. Thank you for your co-operation.