20

This is what I'd like to be able to do:

After a user's account is created, they should be able to ssh-tunnel, but their account is automatically removed after 30 days unless the countdown is reset by the root user.

How can I automate this? I'll have to handle around 15 users.

29

useradd

You can control how long a user's account is valid through the use of the --expiredate option to useradd.

excerpt from useradd man page

-e, --expiredate EXPIRE_DATE
     The date on which the user account will be disabled. The date is
     specified in the format YYYY-MM-DD.

     If not specified, useradd will use the default expiry date specified
     by the EXPIRE variable in /etc/default/useradd, or an empty string 
     (no expiry) by default.

So when setting up the user's account you can specify a date +30 days in the future from now, and add that to your useradd command when setting up their accounts.

$ useradd -e 2013-07-30 someuser

chage

You can also change a existing accounts date using the chage command. To change an accounts expiration date you'd do the following:

$ chage -E 2013-08-30 someuser

calculating the date +30 days from now

To do this is actually pretty trivial using the date command. For example:

$ date -d "30 days"
Sun Jul 28 01:03:05 EDT 2013

You can format using the +FORMAT options to the date command, which ends up giving you the following:

$ date -d "30 days" +"%Y-%m-%d"
2013-05-28

Putting it all together

So knowing the above pieces, here's one way to put it together. First when creating an account you'd run this command:

$ useradd -e `date -d "30 days" +"%Y-%m-%d"` someuser

Then when you want to adjust their expiration dates you'd periodically run this command:

$ chage -E `date -d "30 days" +"%Y-%m-%d"` someuser

Specifying time periods of less than 24h

If you want a user to only be active for some minutes, you cannot use the options above since they require specifying a date. In that case, you could either set up a crontab to remove/lock the created user after the specified time (for example, 10 minutes), or you could do one of:

adduser someuser && sleep 600 && usermod --lock someuser

or

$ adduser someuser
$ echo usermod --lock someuser | at now + 10 minutes

References

  • 3
    I took the liberty to change the %M (Minutes) into %m (month) – Anthon Jun 28 '13 at 5:19
5

If you are on Debian/Ubuntu you should use adduser and usermod. On Debian based systems useradd is considered low level and (according to the man pages): administrators should usually use adduser(8) instead

adduser has a no expiration option, so you just use it to create the account.

usermod has the -e / --expiredate option to set the expiration date.

You calculate the parameter to date with: date -d "30 days" "+%Y-%m-%d" to get:

usermod --expiredate $(date -d "30 days" "+%Y-%m-%d") username
1

Another way (if your OS does not support account expiration or this feature doesn't work for whatever reason): set up a cron job to run 30 days from now that will lock this account.

Usually the account is locked by setting its encrypted password to invalid value; on FreeBSD, pw lock X command will lock the account X.

  • 1
    Explain how you can lock an account. – slm Jun 28 '13 at 5:06
  • That's OS-dependent, really. – sendmoreinfo Jun 28 '13 at 5:09
  • 4
    It would still be helpful if you gave an example showing it. – slm Jun 28 '13 at 5:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.