RE: [hobbit] inactive user accounts

["Dean Casey" <dcasey (at) pathfire.com>]

You might try:

 

-          using a custom script to run "last" command (or parse
lastlog, depending on your OS)

-          compare output of above to field #1 in the etc/passwd file
(possibly using "diff" or similarr command)

-          alert on those names that show up in the output of the above
step

 

www.deadcat.net <http://www.deadcat.net/>  has a few scripts that do
almost what you're thinking of, they should be pretty straightforward to
modify.   

 

Dean Casey 

________________________________

From: Ryan Jay B. Lapuz [mailto:rlapuz (at) fcpp.fujitsu.com] 
Sent: Friday, August 10, 2007 6:26 AM
To: hobbit (at) hswn.dk
Subject: [hobbit] inactive user accounts

 

Hi everyone!

 

Does Hobbit supports monitoring of behavior of user/email accounts like
if the account has been inactive for 30 days?

If not, can someone give me any idea on how to do it?

 

Thanks in advance

 

Regards

 

Ryan