0

I am looking for an easy way to visualise data from etc_security_lastlog for reviewing inactive user IDs. "Inactive" users would be determined based on their time_last_login being old enough. How do I do it?

lp:
time_last_unsuccessful_login = 1174162435
tty_last_unsuccessful_login = /dev/pts/7      
host_last_unsuccessful_login = 1x.xxx.xxx.x.x                                    
unsuccessful_login_count = 1         

smtsftp:
unsuccessful_login_count = 3         
time_last_login = 1382043613
tty_last_login = /dev/ssh-16842912
host_last_login = 1x.xxx.xxx.x.x.net.intra                       
time_last_unsuccessful_login = 1382083294
tty_last_unsuccessful_login = ssh
host_last_unsuccessful_login = 1x.xxx.xxx.x.x.net.intra

svcsinae:
unsuccessful_login_count = 0         

privil1:
unsuccessful_login_count = 0
time_last_login = 1567112152
tty_last_login = /dev/pts/1
host_last_login = 11x.xxx.xxx.x.x              
time_last_unsuccessful_login = 1507892677
tty_last_unsuccessful_login = ssh
host_last_unsuccessful_login = 1x.xxx.xxx.x.x 
  • What are your criteria for "inactive users"? – Jeff Schaller Sep 9 '19 at 12:10
  • based on last login date after a certain period of time, (time_last_login) – teo93 Sep 10 '19 at 2:06
  • How long? And would you ignore unsuccessful login times? – Jeff Schaller Sep 10 '19 at 2:07
0

You could approach this with a simple awk filter; just pass in the current timestamp and the cutoff that you're interested in. It will parse the input looking for usernames and their time_last_login values. If it finds a value that's older than the cutoff, it reports the corresponding user.

The example below uses a rough approximation of 1 year (31,536,000 seconds).

awk -v now=$(date +%s) -v cutoff=31536000 '
  /^[^-+@~ ][^:"#,=\\\/?` ]+:$/ { 
    user=$1
    sub(/:$/, "", user)
  }
  /time_last_login = [[:digit:]]+/ { 
    if (now - $3 > cutoff) print user " has not logged in within the cutoff"
  }
  ' /etc/security/lastlog

The regex I used in searching for the username comes from the mkuser documentation. After capturing the username (line), I remove the trailing colon from the username.

  • this is very helpful! – teo93 Sep 12 '19 at 2:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.