Hello,

I am new to the AIX world.

I am lookginfor help in extracting the following 2 information about
user accounts


1. user_unsuccessful_login (Count for the past 30 days)

For example, I would like to know how many times the user has logged
unsuccessfully during the past 30 days.

I am assuming I need to look in /etc/security/lastlog
and look for the field unsuccessful_login_count=(number). (I want to
know how to extract only the count for last 30 days)


2. user account_locked (count for the past 30 days)

I am assuming I can get this information from /etc/security/user

account_locked=true

I would like to know how many times a particular user has been locked
out for the past 30 days. It appears at this moment, when the user gets
unlocked, the count goes back to 0, so when I do a report at end of
month, I would not be able to capture how many times it was locked
during the month.

Any help would be apperciated!

Peter.

peternjusa@gmail.com wrote:

> I am lookginfor help in extracting the following 2 information about
> user accounts
>
> 1. user_unsuccessful_login (Count for the past 30 days)
>
> For example, I would like to know how many times the user has logged
> unsuccessfully during the past 30 days.
>
> 2. user account_locked (count for the past 30 days)
>
> I am assuming I can get this information from /etc/security/user
>
> account_locked=true


Peter,

For item 1, you can try to use a variation of the following command:

last -f /etc/security/failedlogin

This shows you all the times that a login was unsuccessful. I believe
that if a valid username is used, it shows that name as the source for
the unsuccessful login. If the name is not spelled correctly, it will
list UNKNOWN_USER.


For item 2, I am not sure that there is a way to detect a locked
account after it has been unlocked, but you could set something up so
that when the chuser is called, it runs an audit program, or have it
run through the sudo utility (www.sudo.org). You can also check the
smit.log to see if anyone unlocked an account, then remove the smit.log
each month afterward (of course that will only track smit instances of
chuser).

HTH,

Steve