How to tell if account is used anymore for anything

anon091 · 09-05-2013, 02:33 PM

First, let me apologize, as I know this is a vague question.
Looking in /etc/passwd on a vsftp server, I noticed an account toward the top of that file that doesn't have a shell listed and the home folder for it is no longer valid. I did a su to that account and there's no crontab and if i hit up/down i dont get any recent commands.
What else would you suggest I check before I can feel fairly confident this account is no longer used for anything and can be deleted?

Habitual · 09-05-2013, 03:06 PM

Change the password, sure, but delete? not so much.

Or give the user a false or nologin shell?

Just my advice,

anon091 · 09-05-2013, 04:13 PM

probably solid advice as a first step :-)

but if the account is somehow used for some process local to the server, would doing that give me a hint in either direction?

hybby · 09-05-2013, 06:03 PM

you could always check "last" to see if the user has logged in any time recently...

kooru · 09-06-2013, 01:24 AM

Code:

last username

zhjim · 09-06-2013, 01:50 AM

or grep the auth.log under /var/log

anon091 · 09-06-2013, 08:25 AM

a last username just returns the following, so i'm guessing that means it had to have been before that timestamp.

wtmp begins Mon May 13 13:57:46 2013

I don't see an auth.log in /var/log either.

dinakumar12 · 09-06-2013, 08:33 AM

Please check whether any process is owned by that user by 'ps aux | grep username'

Habitual · 09-06-2013, 09:32 AM

Code:

last <user> -f /var/log/btmp

for historical records, if btmp exists.

anon091 · 09-06-2013, 12:10 PM

nothing from the ps aux

that last command returns this

btmp begins Fri Aug 16 06:37:30 2013

Habitual · 09-06-2013, 01:07 PM

Same reasoning applies, change password, wait, oh say [69]0 days, delete account...

anon091 · 09-06-2013, 01:14 PM

Yeah, I think that's about the only option right now. Thanks for the help.

Habitual · 09-06-2013, 02:26 PM

no worries.
Glad to be of help.

jthill · 09-06-2013, 02:59 PM

Would writing a shell that logs the event someplace handy and then exec's the real login shell work for you?

anon091 · 09-09-2013, 01:59 PM

I don't understand what that would do in this case, can you explain?