Find out or start to log last login of all ftp users

anon091 · 09-03-2013, 05:01 PM

I have an old RHEL vsftp server that has quite a few user accounts that i'm guessing aren't used and haven't been used in some time. Is there a "last login" somewhere that i can list for all the accounts in /etc/passwd or a way i can start logging each users last login so i can check it again in say a few months to see who hasn't even logged in?

unSpawn · 09-03-2013, 06:03 PM

Are these virtual users or do they have actual accounts on the system? How far back do your /var/log/{ftp,vsftp,secure} logs go? How about the mtime of distinctive files owned by respective users?

anon091 · 09-04-2013, 08:19 AM

They're "real" users who show up in /etc/passwd. Looks like my oldest log in /var/log is a .4 from August 11th.

the mtime thing sounds very clever, but I don't know if that would work for all users, as some of the accounts just upload a file that is plucked away within minutes by another process as it's input. Plus i'm not sure how I could generate a report by account like that haha. but it does sound VERY cool.

unSpawn · 09-04-2013, 05:39 PM

Quote:

Originally Posted by rjo98

Looks like my oldest log in /var/log is a .4 from August 11th.

Default log retention (or rather not giving thought to changing defaults) seems to mar a lot of hosts.

Quote:

Originally Posted by rjo98

They're "real" users who show up in /etc/passwd.

Then let's assert they're in /var/log/wtmp as well? (As in 'man last'.)

Quote:

Originally Posted by rjo98

the mtime thing sounds very clever, but I don't know if that would work for all users, as some of the accounts just upload a file that is plucked away within minutes by another process as it's input. Plus i'm not sure how I could generate a report by account like that haha. but it does sound VERY cool.

Well it was just an idea. You could generate a list like this:

Code:

#!/bin/bash --
# For testing:
# set -vx
# Sane defaults:
LANG=C; LC_ALL=C; export LANG LC_ALL; umask 0027
# Get list of users, here any UID of 500 and over
# (value actually is 'awk '/^UID_MIN/ {print $2}' /etc/login.defs;':)
awk -F ':' '{if ($3 >= 500) print $1,$3}' /etc/passwd | while read _LOGNAME _UID; do
 # Echo resolved account name and display latest wtmp entry:
 echo "${_LOGNAME}: $(last -wai|grep -m1 "${_LOGNAME}")"; 
 # Find files (change "/path/to/ftproot") by UID, print epoch and file name, then sort:
 find /path/to/ftproot -user ${_UID} -maxdepth 10 -printf "%T@ %p\n"|sort -nk1
 # * Note UID, level restriction and epoch are for speeding up things. 
 # Separate between users:
 echo
done
exit 0

anon091 · 09-05-2013, 09:02 AM

If I just run a last, all i get are the users who actually ssh to the server, none of the ftp users.

When I run the script, it only returned something useful for my user account, the rest of them it just showed something like

nfsnobody:
find: /path/to: No such file or directory