SEO

Can anyone tell me how to identify accounts that have been inactive
for longer than 90 days? I know I can use the last command for a
single user to tell me the last time they logged on, but I know there
has to be an easier way.

Thanks

In article <2488bbd.0405040635.7b02d928@posting.google.com> , Russ wrote:
> Can anyone tell me how to identify accounts that have been inactive
> for longer than 90 days? I know I can use the last command for a
> single user to tell me the last time they logged on, but I know there
> has to be an easier way.
>
> Thanks

Does your wtmp go back 90 days?
One way is something like:

sed 's/:.*$//' < /etc/passwd | while read id
do
echo $id
last $id | head -2
done

Another way might be to scan /home for a .profile that is older
than 90 days, etc.

Mike <mikee@mikee.ath.cx> wrote in message news:<109fb8p7nup0p4c@corp.supernews.com>...
> In article <2488bbd.0405040635.7b02d928@posting.google.com> , Russ wrote:
> > Can anyone tell me how to identify accounts that have been inactive
> > for longer than 90 days? I know I can use the last command for a
> > single user to tell me the last time they logged on, but I know there
> > has to be an easier way.
> >
> > Thanks
>
> Does your wtmp go back 90 days?
> One way is something like:
>
> sed 's/:.*$//' < /etc/passwd | while read id
> do
> echo $id
> last $id | head -2
> done
>
> Another way might be to scan /home for a .profile that is older
> than 90 days, etc.


/etc/security/lastlog also contains the date and time of each users
last login it's expressed in seconds since the epoch so you would need
a perl script or a program to do the math.

My script looks like this:

#!/usr/bin/perl
require "ctime.pl";

#@(#) lastlogin2.pl -- T.Polzin 6-?-2001
#@(#) Calculates and reports last time a user logged into the system
# ************************************************** ********************
# Input file is usually /etc/security/lastlog
# HISTORY:
# 7-12-01 Decided that o/p wasn't good enough (didn't show who user
really is)
# added get pwnam() routine to retrieve comment from passwd
file.
# ************************************************** ********************
open (STDIN,$ARGV[0]) || die "Can't open $ARGV[0]: $!\n";
@month = (Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec);

$date = &ctime(time);

$pg = 0;
&PGHD;

while(<STDIN>)
{
chop;
if ((index($_,":") > 0) && (index($_,"*") <0))
{
# This chop gets rid of the ":" character which makes the getpwnam
call work
chop;
if ( $lc > 75 )
{
printf("\n\f");
&PGHD;
}
printf("\n%-10s",$_);
@pwent = getpwnam($_);
$pwuid = $pwent[2];
$pwcmt = $pwent[6];
printf(" %-6s %-45s",$pwuid,$pwcmt);
$lc++;
};

if ((index($_,"time_last_login") > 0) && (index($_,"*") <0))
{
($user, $last ) = split (/=/,$_);
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isd st) =
localtime($last);
printf ("%s %02d
%4d\t%2d:%02d",$month[$mon],$mday,$year+1900,$hour,$min);
};
}
printf("\n");

sub PGHD
{
$pg++;
printf("lastlogin2.pl USERS LAST LOGIN DATE/TIME LISTING
PAGE %3d\n",$pg);
printf(" %s\n\n",$date);
printf("USER NAME ID# COMMENT
DATE TIME\n");
$lc = 5;
}