LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 10-30-2007, 12:13 AM   #1
athreyavc
Member
 
Registered: May 2004
Location: bangalore
Distribution: Cent OS, Ubuntu
Posts: 105

Rep: Reputation: 15
Password expiry notification via mail


Hi All,

We are using opensolaris and Linux Machines In test environment. Is there anyway by which I can send the password expiry notifications to the concerned users?

Please help me on this.

Best Regards,
 
Old 10-30-2007, 05:54 PM   #2
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,123

Rep: Reputation: 151Reputation: 151
I'm not sure about OpenSolaris, but on the Linux system I'm using at the moment...

When a password expiry date gets set with usermod, the user's entry in /etc/shadow gets updated. You could run a cron job that checks the /etc/shadow entries and does some maths with the expiry date. When the date is close, you could have the cron job send the user an email.
 
Old 10-31-2007, 01:36 PM   #3
Autocross.US
LQ Newbie
 
Registered: Aug 2006
Location: Chesapeake, VA
Distribution: Solaris, HP-UX, RedHat, Fedora
Posts: 15

Rep: Reputation: 0
Here's a perl script i wrote for our redhat systems that does this. Adapt as needed:

Code:
#! /usr/bin/perl
####################################################################
# Filename:    Password_Exp_Notify.pl
# Date:        August 15 2006
####################################################################
# Description:
# This script emails a user when their:
# - password is within 14 days of expiring.
# - password is expired
#
# This script requires the following to work:
# - Each user needs a $HOME/.forward file that contains a valid
#   email address.
# - The $HOME/.forward file must be owned by the user account
#####################################################################
$HOST=`uname -n`;  chomp($HOST);
$UNIXSUPPORT="some_email@domain.com";
$epoch = int(time/(60*60*24));

open(SHADOW, "< /etc/shadow");
while (<SHADOW>) {
  ($USER, $encr_pass, $created, undef, $exp_days, undef, undef, undef)=split(/:/, $_);
  chomp($shel = `egrep "^$USER:" /etc/passwd | cut -d: -f6`);
  next if $shel =~ m(/sbin/nologin);  # we don't care about accounts w/ nologin shell
  $PASS_AGE = ($exp_days-($epoch-$created));

  if ($encr_pass =~ m{^\!\!$} || $encr_pass =~ m{^\*$}){
          $Nothing = 0; # Account is locked/password not set - skip this condition
          next;


  }elsif ($encr_pass =~ m{^\!.*$})  {
          $Nothing = 0;  # Account is administratively locked - skip this condition
          next;


  } elsif ($created eq "0" || $exp_days eq "99999")  {
          # Password aging is disabled for the account - Set the correct policy for the user
          `passwd -x 90 -w 14 $USER`;                     # password expires in 90 days/Warning 14
          `chage -d 0 $USER`;                             # Force password change on next login
           next;


  } elsif ($PASS_AGE >= 0 && $PASS_AGE <= 14)  {
          # password expires within 14 days - notify user

          $SUBJECT = "Password expiration notification for $USER from $HOST";
          &SendMail("$USER", "$SUBJECT", "

Notice:  The user account $USER will expire in $PASS_AGE days on $HOST.
Login and change the password before the expiration date or the account may be locked.

Your new password must conform to the following policies:
 - Minimum of 8 characters in length
 - Contains at least 1 special character within the first 8 characters
 - Contains at least 1 numeric character within the first 8 characters


Contact the Unix Support Team for any further assistance.
");

         next;



  } elsif ($PASS_AGE < 0 && $PASS_AGE > -90) {
          # password is expired - notify user

          $SUBJECT = "Password expiration notification for $USER from $HOST";
          &SendMail("$USER", "$SUBJECT", "

Notice:  The user account $USER expired $PASS_AGE days ago on $HOST.
Login and change the password or the account may be locked or removed.

Your new password must conform to the following policies:
 - Minimum of 8 characters in length
 - Contains at least 1 special character within the first 8 characters
 - Contains at least 1 numeric character within the first 8 characters

Contact the Unix Support Team for any further assistance.
");

       next;




  } elsif ($PASS_AGE < -90 ) {
          # Password has been expired for more than 90 days - lock and notify support for deletion
          `passwd -l $USER`;                             # Lock the account
          `/usr/sbin/usermod -s /sbin/nologin $USER`;    # Set a nologin shell

          $SUBJECT = "User account $USER has been expired for 90 days or more";
          &SendMail("root", "$SUBJECT", "

Notice:  The user account $USER expired $PASS_AGE days ago on $HOST.
Since the user has not changed the password, consider removing the account.
");
          next;

  }

}
close(SHADOW);

#############################################################################
### Define the subroutines below
#############################################################################

###
#1# Send a message to the user
###
sub SendMail {
  my ($to, $subject, $message) = @_;
  my $sendmail = '/usr/sbin/sendmail';
  open(MAIL, "|$sendmail -oi -t");
  print MAIL "From: $UNIXSUPPORT\n";
  print MAIL "To: $to\n";
  print MAIL "Subject: $subject\n\n";
  print MAIL "$message\n";
  close(MAIL);
}
 
Old 11-01-2007, 07:43 AM   #4
athreyavc
Member
 
Registered: May 2004
Location: bangalore
Distribution: Cent OS, Ubuntu
Posts: 105

Original Poster
Rep: Reputation: 15
Hi Autocross.US,

Thanks a million for the script.

I will surely check the same.

Regards,

Athreya
 
Old 04-18-2008, 03:27 PM   #5
AQG
Member
 
Registered: Jun 2005
Distribution: SuSE, Red Hat
Posts: 161

Rep: Reputation: 30
Hello,

Tried your script, but I get no results nor emails, any ideas of what I'm doing wrong??????

Thanks!!


#1 nothing happens
OUTPUT:
[root@MYSERVER usr/bin]# perl ./password_script.pl
[root@MYSERVER usr/bin]#

#2 in the script do i need to modify something from:
#############################################################################
### Define the subroutines below
#############################################################################

###
#1# Send a message to the user
###
sub SendMail {
my ($to, $subject, $message) = @_;
my $sendmail = '/usr/sbin/sendmail';
open(MAIL, "|$sendmail -oi -t");
print MAIL "From: $UNIXSUPPORT\n";
print MAIL "To: $to\n";
print MAIL "Subject: $subject\n\n";
print MAIL "$message\n";
close(MAIL);

Last edited by AQG; 04-18-2008 at 03:31 PM.
 
Old 04-18-2008, 04:15 PM   #6
AQG
Member
 
Registered: Jun 2005
Distribution: SuSE, Red Hat
Posts: 161

Rep: Reputation: 30
OK,
Got it to work for the local mail to each user but
i don't think it's reading $HOME/.forward How can I verify that it is reading the contents of this $HOME/.forward


Please advice


thanks!!!
 
Old 04-18-2008, 05:02 PM   #7
AQG
Member
 
Registered: Jun 2005
Distribution: SuSE, Red Hat
Posts: 161

Rep: Reputation: 30
Thank you all,

issue was .forward had 777 permissions all that needed was to set it to 400


Thanks!!
 
Old 04-20-2008, 12:31 AM   #8
athreyavc
Member
 
Registered: May 2004
Location: bangalore
Distribution: Cent OS, Ubuntu
Posts: 105

Original Poster
Rep: Reputation: 15
Hi All,

I will try the same.

Thanks a million for the script.

Best Regards,

Athreya VC
 
Old 09-17-2010, 04:40 AM   #9
amit.naudiyal
LQ Newbie
 
Registered: May 2010
Posts: 18

Rep: Reputation: 0
Smile Need Password Expiry Script for Unix System accounts

I am running a Linux FTP server having around 100 systems accounts for which I need password expiry script which could use "email" package and send mails for warning, expiration of accounts etc. Little twist from above post is that the accounts are not user name based but account name based and users are being defined on the GECOS field. So, need modification that mails should be sent to the IDs (mails IDs) defined on GECOS field.

If anyone can guide me on this, it will be helpful for me.
Thanks in advance.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
password expiry notification through mail? dsids Linux - Security 1 06-02-2006 03:00 PM
password expiry notification through mail? dsids Linux - Newbie 2 06-02-2006 02:48 PM
SAmba Password Expiry bally Linux - General 0 11-29-2004 10:42 PM
Password expiry klmn1 Linux - Networking 0 12-29-2002 10:29 PM


All times are GMT -5. The time now is 03:09 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration