Add multiple groups to check last login script

Currently fixed group names sshallow, sshforward and reject sshreject
This commit is contained in:
Clemens Schwaighofer
2022-12-01 06:43:43 +09:00
parent 6e53d1bdec
commit fe08fa10c2
2 changed files with 74 additions and 71 deletions

View File

@@ -213,7 +213,7 @@ This script should be run every day via crontab as root:
0 1 * * * root /root/users/bin/collect_login_data.sh
```
The script `check_last_login.sh` will go through the sshallow groups users and flag out those that have not logged in, in the last 60 days and recommend to lock them. The script will also check for user accounts that never logged in and where created in the last 30 days and recomment to lock them too.
The script `check_last_login.sh` will go through the ssh allow groups (sshallow/sshforward) users and flag out those that have not logged in, in the last 60 days and recommend to lock them. The script will also check for user accounts that never logged in and where created in the last 30 days and recomment to lock them too.
This script will first check the `auth-log/user_auth.log` file, then lastlog output and finally check for creation time in passwd file or home director for when the user was created.
@@ -222,5 +222,5 @@ Currently only information is printed out and no action is done itself.
The script can be put into the crontab and run once a month, it prints to STDOUT so a mail pipe with a proper subject is recommended
```crontab
0 2 1 * * root /root/users/bin/check_last_login.sh | mail -s "$(hostname): user account check"
0 2 1 * * root /root/users/bin/check_last_login.sh | mail -s "User Account check: $(hostname)"
```