c09e8cf799
A new last logged in, last created script has been added to check which users we have to disable. - checks in group sshallow - if last login older than 60days, remove account from ssh group - if we have account create date, check if never logged in and older than 30 days, remove account from ssh group Both dates can be set separate Update create script to add create date in Y-m-d (%F) format as comment to the passwd file Also add user to sshallow group (group always exists, is created on server creation)
81 lines
3.1 KiB
Bash
Executable File
81 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Checks for last access of users in sshallow group
|
|
# if user login >30days, remoe user from sshallow group and write log
|
|
|
|
# which group holds the ssh allowed login users (outside of admin users)
|
|
ssh_group='sshallow';
|
|
# date now for compare
|
|
now=$(date +"%s");
|
|
# max age for last login or account create without login
|
|
max_age_login=60;
|
|
max_age_create=30;
|
|
# one day in seconds
|
|
day=86400;
|
|
# delete account strings
|
|
delete_accounts="";
|
|
|
|
if [ $(whoami) != "root" ]; then
|
|
echo "Script must be run as root user";
|
|
exit;
|
|
fi;
|
|
echo "[START] =============>";
|
|
echo "Max age last login: ${max_age_login} days";
|
|
echo "Max age no login : ${max_age_create} days";
|
|
for user in $(cat /etc/group|grep "${ssh_group}:" | cut -d ":" -f 4 | sed -e 's/,/ /g'); do
|
|
# for user in clemens test42; do
|
|
account_age=0;
|
|
out_string="";
|
|
#echo "* Checking user ${user}";
|
|
# check user create time, if we have set it in comment
|
|
user_create_date=$(cat /etc/passwd | grep "${user}:" | cut -d ":" -f 5);
|
|
# if empty try last password set time
|
|
if [ -z "${user_create_date}" ]; then
|
|
# user L 11/09/2020 0 99999 7 -1
|
|
user_create_date=$(passwd -S ${user} | cut -d " " -f 3);
|
|
fi;
|
|
# last try is user home .bash_logout
|
|
if [ -z "${user_create_date}" ]; then
|
|
home_dir=$(cat /etc/passwd | grep "${user}:" | cut -d ":" -f 6)"/.bash_logout";
|
|
user_create_date=$(stat -c %Z "${home_dir}");
|
|
fi;
|
|
# Username Port From Latest
|
|
# user pts/35 10.110.160.230 Wed Nov 2 09:40:35 +0900 2022
|
|
last_login_string=$(lastlog -u ${user} | sed 1d);
|
|
search="Never logged in";
|
|
# if we have "** Never logged in**" the user never logged in
|
|
if [ ! -z "${last_login_string##*$search*}" ]; then
|
|
# find \w{3} \w{3} [\s\d]{2} \d{2}:\d{2}:\d{2} \+\d{4} \d{4}
|
|
# awk '{for(i=4;i<=NF;++i)printf $i FS}'
|
|
last_login_date=$(echo "${last_login_string}" | awk '{for(i=4;i<=NF;++i)printf $i FS}' | date +"%s" -f -);
|
|
# date -d "Wed Nov 2 09:40:35 +0900 2022" +%s
|
|
last_login=$(awk '{printf("%.0f\n",($1-$2)/$3)}' <<<"${now} ${last_login_date} ${day}");
|
|
if [ ${last_login} -gt ${max_age_login} ]; then
|
|
out_string="[!] last logged in ${last_login} days ago. Locking account";
|
|
delete_accounts="${delete_accounts}deluser ${user} ${ssh_group};";
|
|
else
|
|
out_string="OK";
|
|
fi;
|
|
elif [ ! -z "${user_create_date}" ]; then
|
|
user_create_date=$(echo "${user_create_date}" | date +"%s" -f -);
|
|
# if all empty, we continue with only check if user has last login date
|
|
# else get days since creation
|
|
#account_age=$[ ($(date +"%s")-$(date -d "${user_create_date}" +"%s"))/24 ];
|
|
account_age=$(awk '{printf("%.0f\n",($1-$2)/$3)}' <<<"${now} ${user_create_date} ${day}");
|
|
if [ ${account_age} -gt ${max_age_create} ]; then
|
|
out_string="[!!!] Never logged in, account created ${account_age} days ago. Locking account";
|
|
delete_accounts="${delete_accounts}deluser ${user} ${ssh_group};";
|
|
else
|
|
out_string="OK";
|
|
fi;
|
|
else
|
|
out_string="[!!!] Never logged in and we have no create date";
|
|
fi;
|
|
printf "* Checking user %-20s: %s\n" "${user}" "${out_string}";
|
|
done;
|
|
echo "--------------------->"
|
|
echo ${delete_accounts};
|
|
echo "[END] ===============>"
|
|
|
|
# __END__
|