Need to generate a report on Users that log in to the server
lalaker
I have been given a task to generate a report, something like an
audit report, for all the user that:
1. have logged into the server
2. No. of times failed to login to the server
3. Accounts that have been locked etc....
I am running SCO openserver 5.0.5 and 5.0.6. Was wondering if anyone
can help me.
Thanks in advance.
lalaker
John DuBois
lalaker <praja...@hotmail.com> wrote:
> I have been given a task to generate a report, something like an
>audit report, for all the user that:
>1. have logged into the server
>2. No. of times failed to login to the server
>3. Accounts that have been locked etc....
Try this:
ftp://ftp.armory.com/pub/scripts/lastlogin
To run it you will need:
ftp://ftp.armory.com/pub/scobins/gawk
The header mentions a couple of other bits you can pick up for full
functionality, but you won't need them to do this:
$ lastlogin -Ha -rlBk
User Last Login #Unsuc L
root Wed Dec 18 01:45 1 -
spcecdt Mon Jan 13 03:49 - -
...
'a' causes the report to list all "real users".
The "Last Login" field will be "-" for those who have never logged in.
#Unsuc is the number of consecutive unsuccessful login attempts.
The L field will be "L" for those whose accounts are locked.
The #Unsuc and L report data come from the TCB database and so are only
available if lastlogin is run by root.
There are many other options:
ftp://ftp.armory.com/pub/scripts/help_pages/lastlogin
John
--
John DuBois spc...@armory.com KC6QKZ/AE http://www.armory.com/~spcecdt/
Bob Meyers
"John DuBois" <spc...@deeptht.armory.com> wrote in message
news:3e277717$0$79558$8ee...@newsreader.tycho.net...
> In article <45f17a6b.03011...@posting.google.com>,
> lalaker <praja...@hotmail.com> wrote:
> > I have been given a task to generate a report, something like an
> >audit report, for all the user that:
> >1. have logged into the server
> >2. No. of times failed to login to the server
> >3. Accounts that have been locked etc....
>
> Try this:
> ftp://ftp.armory.com/pub/scripts/lastlogin
> To run it you will need:
> ftp://ftp.armory.com/pub/scobins/gawk
Thanks John. When I stuck the above on a 5.0.5 and ran it it made error:
error opening /usr/lib/libsocket.so.2
Got a clue on that? I don't have a certain lib apparently.
Jean-Pierre Radley
From my ssh/README:
You need /usr/lib/libsocket.so.2 and /usr/lib/libresolv.so.1. RS506a
will have installed them, but if you have OSR 5.0.5, they are also in
CSSA-2002-SCO.39, which you should get from stage.caldera.com (you
should install that CSSA on 5.0.6 too!
--
JP
John DuBois
> I have been given a task to generate a report, something like an
>audit report, for all the user that:
>1. have logged into the server
>2. No. of times failed to login to the server
>3. Accounts that have been locked etc....
I should've also mentioned that you can do it with just the utilities available
on the system, though with a somewhat more obtuse output format:
userls -x '{lastSuccessfulLoginTime} {lastUnsuccessfulLoginTime} {unsuccessfulLoginAttempts}'
See the userls man page for the other values you can give with -x.
lalaker
> In article <45f17a6b.03011...@posting.google.com>,
> lalaker <praja...@hotmail.com> wrote:
> >Folks,
> > I have been given a task to generate a report, something like an
> >audit report, for all the user that:
> >1. have logged into the server
> >2. No. of times failed to login to the server
> >3. Accounts that have been locked etc....
>
> I should've also mentioned that you can do it with just the utilities available
> on the system, though with a somewhat more obtuse output format:
>
> userls -x '{lastSuccessfulLoginTime} {lastUnsuccessfulLoginTime} {unsuccessfulLoginAttempts}'
>
> See the userls man page for the other values you can give with -x.
>
> John
John,
I put your gawk script on one of my servers and I get the follow
error:
:-ksh:root 413 ] ./lastlogin
Oops... got unknown home 'sh:' from stat output:
sh: stat: not found
sh: stat: not found
Haven't been able to figure it out yet. I also used the userls
command. It works pretty well. I still want your script to work on my
system.
John DuBois
lalaker <praja...@hotmail.com> wrote:
> I put your gawk script on one of my servers and I get the follow
>error:
>
>:-ksh:root 413 ] ./lastlogin
>Oops... got unknown home 'sh:' from stat output:
>sh: stat: not found
>sh: stat: not found
Sory, I should have said to use:
$ lastlogin -Ha -rbBk
That will get the last login time from the TCB database instead of the user's
.lastlogin file (which requires stat).
If you want full functionality from lastlogin, you'll have to pick up stat and
other utilities as described in the header of the lastlogin program.