Check local UNIX inactive logins

[ParkIsland]

I need to check all inactive Unix logins in over 100 Solaris and Linux servers. Those servers are not NIS clients. If users don't logon or change password within 90 days, their accounts are inactive logins. Any tools or scripts to collect the inactive logins?

 

[chipk]

I wrote a script that runs on an individual box, which checks the password age of a given logon. It's pretty simple, and could be adapted to check multiple logons on the same box, but running it on 100 boxes would require quite a bit more development. Here is the basic script:

#Exports root entry from /etc/shadow file.
/usr/bin/grep -i root /etc/shadow > /tmp/shad
#
#Creates temp file with root's password age from epoch.
ROOTAGE=`/usr/bin/awk 'BEGIN { FS=":" } { print $3 }' /tmp/shad`
#
#Gets current time since epoch.
/usr/bin/truss /usr/bin/date 2>&1 | /usr/bin/awk '/^time/ {print $NF}' >/tmp/tmp.txt
#
#truncates file because above command duplicates number in output.
TMP=`tail -1 /tmp/tmp.txt`
#
#Divides root's epoch time by 86400 (number of seconds in a day)
AGE=`expr $TMP / 86400`
#
#Subtracts roots password age from days since epoch.
FINAL=`expr $AGE - $ROOTAGE`
#
#Create text file and e-mail results to administrator.
if test $FINAL -ge 90
then
echo "Root's password is" $FINAL "days old." > /tmp/final.txt
/usr/lib/sendmail -t chipk@domain.com < /tmp/final.txt
fi
exit

To run it against multiple boxes, you would need some kind of telnet script and a text file with all your servers in it so you could run a for loop against it. I'm working on learning Perl right now, because it has the ability to do stuff like this.

Anyway, hope this is helpful, even though it's not exactly what you're looking for.

 

[kordaff]

How about a file with hosts you want to run this on named hosts.txt. Then do this:

for i in in `cat hosts.txt`
do
ssh $i ~/find-inactive # where find-inactive is the script
# that you're using which is installed at ~/ on each host
# in that hosts.txt file
done

I've used something similar to admin multiple hosts from one central location. It can be very useful if all hosts have at least one nfs share in common.

Having an account that can run that script as root setup so you can ssh in without a password (ssh-agent and RSA keys are your friend) make it quick. Best if those hosts aren't reachable from the public internet though, go through a bastion host or two at least.

Sometimes the script I run is bash etc, sometimes it's perl, depends on what I'm doing.