ScriptsCollections/ServerUserCreate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix lock user flow to only lock if the user is not in the reject group

Browse Source
This commit is contained in:
Clemens Schwaighofer
2023-12-21 15:58:28 +09:00
parent cc647de495
commit d4bb06e3e1
1 changed files with 17 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
bin/check_last_login.sh
View File

@@ -53,7 +53,7 @@ case "${1,,}" in
;; ;;
esac; esac;
if [ "${OUTPUT_TARGET}" == "text" ]; then if [ "${OUTPUT_TARGET}" = "text" ]; then
LOG="${LOG}/check_ssh_user."$(date +"%F_%H%m%S")".log"; LOG="${LOG}/check_ssh_user."$(date +"%F_%H%m%S")".log";
exec &> >(tee -a "${LOG}"); exec &> >(tee -a "${LOG}");
echo "[START] =============>"; echo "[START] =============>";
@@ -62,7 +62,7 @@ if [ "${OUTPUT_TARGET}" == "text" ]; then
echo "Max age last login : ${max_age_login} days"; echo "Max age last login : ${max_age_login} days";
echo "Warn age last login: ${warn_age_login} days"; echo "Warn age last login: ${warn_age_login} days";
echo "Max age no login : ${max_age_create} days"; echo "Max age no login : ${max_age_create} days";
elif [ "${OUTPUT_TARGET}" == "json" ]; then elif [ "${OUTPUT_TARGET}" = "json" ]; then
echo '"Info": {' echo '"Info": {'
echo '"Hostname": "'$(hostname)'",'; echo '"Hostname": "'$(hostname)'",';
echo '"Date": "'$(date +"%F %T")'",'; echo '"Date": "'$(date +"%F %T")'",';
@@ -73,9 +73,9 @@ elif [ "${OUTPUT_TARGET}" == "json" ]; then
echo '"Users": [' echo '"Users": ['
fi; fi;
for ssh_group in ${ssh_groups[@]}; do for ssh_group in ${ssh_groups[@]}; do
if [ "${OUTPUT_TARGET}" == "text" ]; then if [ "${OUTPUT_TARGET}" = "text" ]; then
echo "--------------------->" echo "--------------------->"
if [ "${ssh_group}" == "${ssh_reject_group}" ]; then if [ "${ssh_group}" = "${ssh_reject_group}" ]; then
echo "Showing current SSH Reject users:"; echo "Showing current SSH Reject users:";
unlock_flag=1 unlock_flag=1
else else
@@ -112,7 +112,7 @@ for ssh_group in ${ssh_groups[@]}; do
continue; continue;
fi; fi;
# for json output, we need , between outputs # for json output, we need , between outputs
if [ "${OUTPUT_TARGET}" == "json" ] && [ $first_run -eq 0 ]; then if [ "${OUTPUT_TARGET}" = "json" ] && [ $first_run -eq 0 ]; then
echo ","; echo ",";
fi; fi;
first_run=0; first_run=0;
@@ -172,7 +172,9 @@ for ssh_group in ${ssh_groups[@]}; do
last_login=$(awk '{printf("%.0f\n",($1-$2)/$3)}' <<<"${now} ${last_login_date} ${day}"); last_login=$(awk '{printf("%.0f\n",($1-$2)/$3)}' <<<"${now} ${last_login_date} ${day}");
if [ ${last_login} -gt ${max_age_login} ]; then if [ ${last_login} -gt ${max_age_login} ]; then
out_string="[!] last ssh log in ${last_login} days ago"; out_string="[!] last ssh log in ${last_login} days ago";
lock_user=1; if [ "${ssh_group}" != "${ssh_reject_group}" ]; then
lock_user=1;
fi;
elif [ ${last_login} -gt ${warn_age_login} ]; then elif [ ${last_login} -gt ${warn_age_login} ]; then
out_string="OK [last ssh login ${last_login} days ago"; out_string="OK [last ssh login ${last_login} days ago";
else else
@@ -190,7 +192,9 @@ for ssh_group in ${ssh_groups[@]}; do
last_login=$(awk '{printf("%.0f\n",($1-$2)/$3)}' <<<"${now} ${last_login_date} ${day}"); last_login=$(awk '{printf("%.0f\n",($1-$2)/$3)}' <<<"${now} ${last_login_date} ${day}");
if [ ${last_login} -gt ${max_age_login} ]; then if [ ${last_login} -gt ${max_age_login} ]; then
out_string="[!] last terminal log in ${last_login} days ago"; out_string="[!] last terminal log in ${last_login} days ago";
lock_user=1; if [ "${ssh_group}" != "${ssh_reject_group}" ]; then
lock_user=1;
fi;
elif [ ${last_login} -gt ${warn_age_login} ]; then elif [ ${last_login} -gt ${warn_age_login} ]; then
out_string="OK [last terminal login ${last_login} days ago"; out_string="OK [last terminal login ${last_login} days ago";
else else
@@ -201,7 +205,9 @@ for ssh_group in ${ssh_groups[@]}; do
elif [ ! -z "${user_create_date}" ]; then elif [ ! -z "${user_create_date}" ]; then
if [ ${account_age} -gt ${max_age_create} ]; then if [ ${account_age} -gt ${max_age_create} ]; then
out_string="[!] Never logged in: account created ${account_age} days ago"; out_string="[!] Never logged in: account created ${account_age} days ago";
lock_user=1; if [ "${ssh_group}" != "${ssh_reject_group}" ]; then
lock_user=1;
fi;
else else
out_string="OK [Never logged in]"; out_string="OK [Never logged in]";
fi; fi;
@@ -222,7 +228,7 @@ for ssh_group in ${ssh_groups[@]}; do
sub_groups_string="[" sub_groups_string="["
sub_group_first=1 sub_group_first=1
for s_group in $sub_groups; do for s_group in $sub_groups; do
if [ "${sub_group_first}" == 0 ]; then if [ "${sub_group_first}" = 0 ]; then
sub_groups_string="${sub_groups_string},"; sub_groups_string="${sub_groups_string},";
fi; fi;
sub_groups_string="${sub_groups_string}\"${s_group}\""; sub_groups_string="${sub_groups_string}\"${s_group}\"";
@@ -249,7 +255,7 @@ for ssh_group in ${ssh_groups[@]}; do
esac; esac;
done; done;
done; done;
if [ "${OUTPUT_TARGET}" == "text" ]; then if [ "${OUTPUT_TARGET}" = "text" ]; then
if [ ! -z "${lock_accounts}" ]; then if [ ! -z "${lock_accounts}" ]; then
echo "--------------------->" echo "--------------------->"
echo "% Run script below to move users to reject ssh group"; echo "% Run script below to move users to reject ssh group";
@@ -267,7 +273,7 @@ if [ "${OUTPUT_TARGET}" == "text" ]; then
echo "bin/unlock_user.sh -s forward ${lock_accounts}"; echo "bin/unlock_user.sh -s forward ${lock_accounts}";
fi; fi;
echo "[END] ===============>" echo "[END] ===============>"
elif [ "${OUTPUT_TARGET}" == "json" ]; then elif [ "${OUTPUT_TARGET}" = "json" ]; then
# users # users
echo "]"; echo "]";
# overall # overall