Need to generate a report on Users that log in to the server

0 views
Skip to first unread message

lalaker

unread,
Jan 16, 2003, 12:25:55 PM1/16/03
to
Folks,
I have been given a task to generate a report, something like an
audit report, for all the user that:
1. have logged into the server
2. No. of times failed to login to the server
3. Accounts that have been locked etc....


I am running SCO openserver 5.0.5 and 5.0.6. Was wondering if anyone
can help me.

Thanks in advance.

lalaker

John DuBois

unread,
Jan 16, 2003, 10:23:03 PM1/16/03
to
In article <45f17a6b.03011...@posting.google.com>,

lalaker <praja...@hotmail.com> wrote:
> I have been given a task to generate a report, something like an
>audit report, for all the user that:
>1. have logged into the server
>2. No. of times failed to login to the server
>3. Accounts that have been locked etc....

Try this:

ftp://ftp.armory.com/pub/scripts/lastlogin

To run it you will need:

ftp://ftp.armory.com/pub/scobins/gawk

The header mentions a couple of other bits you can pick up for full
functionality, but you won't need them to do this:

$ lastlogin -Ha -rlBk
User Last Login #Unsuc L
root Wed Dec 18 01:45 1 -
spcecdt Mon Jan 13 03:49 - -
...

'a' causes the report to list all "real users".
The "Last Login" field will be "-" for those who have never logged in.
#Unsuc is the number of consecutive unsuccessful login attempts.
The L field will be "L" for those whose accounts are locked.

The #Unsuc and L report data come from the TCB database and so are only
available if lastlogin is run by root.

There are many other options:
ftp://ftp.armory.com/pub/scripts/help_pages/lastlogin

John
--
John DuBois spc...@armory.com KC6QKZ/AE http://www.armory.com/~spcecdt/

Bob Meyers

unread,
Jan 17, 2003, 3:16:53 PM1/17/03
to

"John DuBois" <spc...@deeptht.armory.com> wrote in message
news:3e277717$0$79558$8ee...@newsreader.tycho.net...

> In article <45f17a6b.03011...@posting.google.com>,
> lalaker <praja...@hotmail.com> wrote:
> > I have been given a task to generate a report, something like an
> >audit report, for all the user that:
> >1. have logged into the server
> >2. No. of times failed to login to the server
> >3. Accounts that have been locked etc....
>
> Try this:
> ftp://ftp.armory.com/pub/scripts/lastlogin
> To run it you will need:
> ftp://ftp.armory.com/pub/scobins/gawk

Thanks John. When I stuck the above on a 5.0.5 and ran it it made error:

error opening /usr/lib/libsocket.so.2

Got a clue on that? I don't have a certain lib apparently.


Jean-Pierre Radley

unread,
Jan 17, 2003, 5:34:20 PM1/17/03
to ScoMisc [c.u.s.m]
Bob Meyers typed (on Fri, Jan 17, 2003 at 12:16:53PM -0800):


From my ssh/README:

You need /usr/lib/libsocket.so.2 and /usr/lib/libresolv.so.1. RS506a
will have installed them, but if you have OSR 5.0.5, they are also in
CSSA-2002-SCO.39, which you should get from stage.caldera.com (you
should install that CSSA on 5.0.6 too!


--
JP

John DuBois

unread,
Jan 17, 2003, 10:46:27 PM1/17/03
to
>Folks,
> I have been given a task to generate a report, something like an
>audit report, for all the user that:
>1. have logged into the server
>2. No. of times failed to login to the server
>3. Accounts that have been locked etc....

I should've also mentioned that you can do it with just the utilities available
on the system, though with a somewhat more obtuse output format:

userls -x '{lastSuccessfulLoginTime} {lastUnsuccessfulLoginTime} {unsuccessfulLoginAttempts}'

See the userls man page for the other values you can give with -x.

lalaker

unread,
Jan 22, 2003, 10:56:45 AM1/22/03
to
spc...@deeptht.armory.com (John DuBois) wrote in message news:<3e28ce13$0$79558$8ee...@newsreader.tycho.net>...

> In article <45f17a6b.03011...@posting.google.com>,
> lalaker <praja...@hotmail.com> wrote:
> >Folks,
> > I have been given a task to generate a report, something like an
> >audit report, for all the user that:
> >1. have logged into the server
> >2. No. of times failed to login to the server
> >3. Accounts that have been locked etc....
>
> I should've also mentioned that you can do it with just the utilities available
> on the system, though with a somewhat more obtuse output format:
>
> userls -x '{lastSuccessfulLoginTime} {lastUnsuccessfulLoginTime} {unsuccessfulLoginAttempts}'
>
> See the userls man page for the other values you can give with -x.
>
> John

John,
I put your gawk script on one of my servers and I get the follow
error:

:-ksh:root 413 ] ./lastlogin
Oops... got unknown home 'sh:' from stat output:
sh: stat: not found
sh: stat: not found

Haven't been able to figure it out yet. I also used the userls
command. It works pretty well. I still want your script to work on my
system.

John DuBois

unread,
Jan 23, 2003, 1:45:42 AM1/23/03
to
In article <45f17a6b.03012...@posting.google.com>,

lalaker <praja...@hotmail.com> wrote:
> I put your gawk script on one of my servers and I get the follow
>error:
>
>:-ksh:root 413 ] ./lastlogin
>Oops... got unknown home 'sh:' from stat output:
>sh: stat: not found
>sh: stat: not found

Sory, I should have said to use:

$ lastlogin -Ha -rbBk

That will get the last login time from the TCB database instead of the user's
.lastlogin file (which requires stat).

If you want full functionality from lastlogin, you'll have to pick up stat and
other utilities as described in the header of the lastlogin program.

Reply all
Reply to author
Forward
0 new messages