help with script: all accounts must be set to expire and go inactive

crimsonclay · 12-10-2013, 11:22 AM

I have been assigned a project at work where all accounts on approx 450 RHEL servers must be set to expire and go inactive. There will be exceptions on service accounts and so forth, but for the majority all need to be modified.

I can use the command below to set each account individually, but that will take forever.

chage -M 90 -W 14 -I 90 "username"

Here's what I would like to do.

Create a simple script to go through /etc/passwd and check to see which accounts meet the criteria
Generate a text file and place it in /tmp
Crearte another script to read that txt file and modify the user accounts in the text file

Those are just my thoughts. If anyone has any ideas, please let me know. I am definitely not a scripter so your input will be greatly appreciated.

linosaurusroot · 12-10-2013, 11:29 AM

This should be done without using the intermediate temporary file.

Are all accounts to be processed in local /etc/passwd,/etc/shadow files?

crimsonclay · 12-10-2013, 11:39 AM

yes, all accounts are processed in local /etc/passwd and /etc/shadow files.

I have to mention, I do not know yet what accounts can not be modified; that is, accounts for oracle and so forth.

shivaa · 12-10-2013, 11:39 AM

Do you want to invoke the same change to all users available in your /etc/passwd file? Or want to exclude some of them? Otherwise, for all users, you can do it with simple script like this:

Code:

~$ vi chagescript.sh
#!/bin/bash
awk -F":" '{print $1}' /etc/passwd > /tmp/users.txt
while read -r user
do
chage -M 90 -W 14 -I 90 $user
echo "Modification done for user $user".
done < /tmp/users.txt

Then make it executable, as:

Code:

~$ chmod +x chagescript.sh

crimsonclay · 12-10-2013, 11:42 AM

Some will have to be excluded. For example, oracle related accounts and mysql accounts. Those specific accounts have not been defined as of yet.

crimsonclay · 12-10-2013, 11:48 AM

Basically, i need to scan for any accounts in the /etc/shadow file that do not end in :15975:0:90:14:90::

A cursory glance of the /etc/shadow file seems to indicate that anything with a second field of * or !! are service accounts that should be excluded.

shivaa · 12-10-2013, 10:02 PM

Quote:

Those specific accounts have not been defined as of yet.

To me, the only concern seems is to list out user accounts. However, exacctly define which account should be included and which should be excluded, then come back.

SAbhi · 12-10-2013, 11:14 PM

Quote:

Originally Posted by crimsonclay

Basically, i need to scan for any accounts in the /etc/shadow file that do not end in :15975:0:90:14:90::

A cursory glance of the /etc/shadow file seems to indicate that anything with a second field of * or !! are service accounts that should be excluded.

So you need to exclude all system accounts for those login shell as defined as /bin/nologin

Code:

for i in $(awk -F":" '/nologin/ {print $1}' /etc/passwd)
do
echo "$i"
done

OR

for i in $(awk -F":" '/*/||/!!/ {print $1}' /etc/shadow)  #could be more simply formatted
do
echo "$i"
done

above will do it simply.

crimsonclay · 12-11-2013, 08:33 AM

So, the command to list out the accounts that will need modifying is below.

cat /etc/shadow | grep -v '0:90:14:90::' | grep -v '!:' | grep -v '*\:'

I can redirect the output to /tmp/chage. With that output, how can I proceed with a script to set the inactive and expire flags?

druuna · 12-11-2013, 10:36 AM

Quote:

Originally Posted by crimsonclay

So, the command to list out the accounts that will need modifying is below.

cat /etc/shadow | grep -v '0:90:14:90::' | grep -v '!:' | grep -v '*\:'

I can redirect the output to /tmp/chage. With that output, how can I proceed with a script to set the inactive and expire flags?

Be careful when using * and ! (!!).

The passwd field can hold any character. *, ! and !! are often seen but it can also be empty or any other character!!

Also: rejecting lines with nologin is also not full-proof (check your passwd file).

If I assume the default way of encrypting passwords is used you could look for lines that have a $ as first character in field 2 and as an extra reject lines with 0:90:14:90::. Even then you might need to check if the results are all ok.

Have a look at this:

Code:

#!/bin/bash

while read THISUSER 
do
  # this would be exectued, its just echoed atm.
  echo "chage -M 90 -W 14 -I 90 $THISUSER"
done < <( awk -F: '$2 ~ /^\$./ { if ( $0 !~ "0:90:14:90::" ) print $1 }' /etc/shadow )

The above code won't change anything, it only echo's the command's that would be executed. Change echo "chage -M 90 -W 14 -I 90 $THISUSER" to chage -M 90 -W 14 -I 90 $THISUSER if this double and triple checked.

EDIT: Do make sure you have backups of the files concerned before starting this action!