83 lines
3.1 KiB
Bash
Executable File
83 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Checks for last access of users in sshallow group
|
|
# if user login >30days, remoe user from sshallow group and write log
|
|
|
|
# which group holds the ssh allowed login users (outside of admin users)
|
|
ssh_group='sshallow';
|
|
# date now for compare
|
|
now=$(date +"%s");
|
|
# max age for last login or account create without login
|
|
max_age_login=60;
|
|
max_age_create=30;
|
|
# one day in seconds
|
|
day=86400;
|
|
# delete account strings
|
|
delete_accounts="";
|
|
|
|
if [ $(whoami) != "root" ]; then
|
|
echo "Script must be run as root user";
|
|
exit;
|
|
fi;
|
|
echo "[START] =============>";
|
|
echo "Max age last login: ${max_age_login} days";
|
|
echo "Max age no login : ${max_age_create} days";
|
|
for user in $(cat /etc/group|grep "${ssh_group}:" | cut -d ":" -f 4 | sed -e 's/,/ /g'); do
|
|
# for user in clemens test42; do
|
|
account_age=0;
|
|
out_string="";
|
|
#echo "* Checking user ${user}";
|
|
# check user create time, if we have set it in comment
|
|
user_create_date=$(cat /etc/passwd | grep "${user}:" | cut -d ":" -f 5);
|
|
# if empty try last password set time
|
|
if [ -z "${user_create_date}" ]; then
|
|
# user L 11/09/2020 0 99999 7 -1
|
|
user_create_date=$(passwd -S ${user} | cut -d " " -f 3);
|
|
fi;
|
|
# last try is user home .bash_logout
|
|
if [ -z "${user_create_date}" ]; then
|
|
home_dir=$(cat /etc/passwd | grep "${user}:" | cut -d ":" -f 6)"/.bash_logout";
|
|
user_create_date=$(stat -c %Z "${home_dir}");
|
|
fi;
|
|
# Username Port From Latest
|
|
# user pts/35 10.110.160.230 Wed Nov 2 09:40:35 +0900 2022
|
|
last_login_string=$(lastlog -u ${user} | sed 1d);
|
|
search="Never logged in";
|
|
# if we have "** Never logged in**" the user never logged in
|
|
if [ ! -z "${last_login_string##*$search*}" ]; then
|
|
# find \w{3} \w{3} [\s\d]{2} \d{2}:\d{2}:\d{2} \+\d{4} \d{4}
|
|
# awk '{for(i=4;i<=NF;++i)printf $i FS}'
|
|
last_login_date=$(echo "${last_login_string}" | awk '{for(i=4;i<=NF;++i)printf $i FS}' | date +"%s" -f -);
|
|
# date -d "Wed Nov 2 09:40:35 +0900 2022" +%s
|
|
last_login=$(awk '{printf("%.0f\n",($1-$2)/$3)}' <<<"${now} ${last_login_date} ${day}");
|
|
if [ ${last_login} -gt ${max_age_login} ]; then
|
|
out_string="[!] last logged in ${last_login} days ago";
|
|
delete_accounts="${delete_accounts}deluser ${user} ${ssh_group};";
|
|
else
|
|
out_string="OK";
|
|
fi;
|
|
elif [ ! -z "${user_create_date}" ]; then
|
|
user_create_date=$(echo "${user_create_date}" | date +"%s" -f -);
|
|
# if all empty, we continue with only check if user has last login date
|
|
# else get days since creation
|
|
#account_age=$[ ($(date +"%s")-$(date -d "${user_create_date}" +"%s"))/24 ];
|
|
account_age=$(awk '{printf("%.0f\n",($1-$2)/$3)}' <<<"${now} ${user_create_date} ${day}");
|
|
if [ ${account_age} -gt ${max_age_create} ]; then
|
|
out_string="[!] Never logged in, account created ${account_age} days ago";
|
|
delete_accounts="${delete_accounts}deluser ${user} ${ssh_group};";
|
|
else
|
|
out_string="OK";
|
|
fi;
|
|
else
|
|
out_string="[!!!] Never logged in and we have no create date";
|
|
fi;
|
|
printf "* Checking user %-20s: %s\n" "${user}" "${out_string}";
|
|
done;
|
|
if [ ! -z "${delete_accounts}" ]; then
|
|
echo "--------------------->"
|
|
echo ${delete_accounts};
|
|
fi;
|
|
echo "[END] ===============>"
|
|
|
|
# __END__
|