Problem writing script to kill a user 1

[linedancer888]

Hi,
I need to write a script to kill a specific user if it's been logged on for more than 25 minutes. This userid is logged on automatically and may have several sessions at once. TMOUT won't work, becuase when the userid logs in, it goes automatically into the program, plus all the users use the same home directory so I can't really change the .profile. I just don't know where to begin with this one.

Thanks for any help.

 

[columb]

A starting point is

who|grep username

which will give a list of sessions complete with tty or pty and login time.

As an example

who | grep root

returns, on my system,

root        pts/12      29 Feb 09:16     (b01301)

From this you can identify the processes associated with a particular login using something like

ps -fu username|grep $pty

i.e.,using my previous example,

ps -fu root| grep pts/12

returns

    root 281614 312652   0 09:16:38 pts/12  0:00 -ksh
    root 312652  29750   0 09:16:37      -  0:00 sshd: root@pts/12

However, now we hit the difficult bit, and that's the 25 minutes calculation. Manipulating dates in ksh is notoriously difficult and calculating whether 25 minutes has elapsed, especially if it goes over midnight, is not going to be easy.

Maybe someone else has some ideas on that one.

On the internet no one knows you're a dog

Columb Healy

 

[p5wizard]

I'd put something like in the .profile :

[tt]if [ ${LOGNAME} = user25 ] # whichever user's sessions you want to limit
then
UIDPID=$$
( /bin/ksh -c "( sleep 1500; kill -9 ${UIDPID} ) &" >/dev/null 2>&1 )
fi[/tt]

An indirect background via ksh -c, so the shell forgets about the background job and doesn't complain about it when the user should log out before his/her 25mins are up.

By logging in, an alarm clock is set to kill the user's login shell process after 25 mins.


HTH,

p5wizard

 

[andy61]

This is from a script of mine and gives the elapsed time of a process in seconds, so maybe you could adapt it if you identify possible suspect processes

ps -o etime -p 12345 | nawk -F '[-:]' 'BEGIN
{i=1;k=NF;split("1,60,3600,86400", vl, ",") }
  !/ELAPS/ { for (k=NF;k>0;--k) {  tot+=($k*vl[i]);++i } }
    END { print tot }';

 

[linedancer888]

Thanks P5wizard, that one seems to be working.