Disable an active users this is another lesson where the security comes in and not like actual security.
I mean the security concerns are that just the users who are not logged into the system for a certain
number of days should be inactive.
So we will run the command and this lesson to identify those users and how does it work in a real world.
Well it happened to me many people and I'm sure I'd have happened to you too that your boss comes to
you and says hey give me a list of all the users who haven't been logged in for the past three months
or a year.
Well you could do two things with that.
This is one who people who are already working in your environment and they just don't have the need
to log in anymore.
So you want to go in and delete your account.
That's one second reason.
People who have left the company and somehow you missed one of the servers or a few servers where you
forgot to delete user account of that person who left the company.
So of course there's a security concern right if the user account is still there.
Well mistakes do happen and you do forget to delete user account on certain number of servers.
Actually if you have thousand servers then forget about it.
So what do you need to do you have to implement some kind of automation tool that will Raun like after
90 days or after a year or whatever the number of days you want to run it which will pick up all these
users that haven't been logged into the system and it will simply disable them.
You can also lead it if you want to but better disable it.
This is what we are going to do and this lesson will first identify the users then we will create a
script.
It will create two type of script one script is for loop script which will look for all the users and
disable the inactive accounts that is the second script that we will create as it will be exactly the
same script but we will use X argument command which is in your command.
I'll show you that could be used in scripting language to take the input from the command and execute
another command on it.
So that's how we will do.
And so let's log into our machine our Linux machine.
Now again as I said I have created these scripts for you already to save time.
So the script that I first created is let's VI that script and I name it disable app users for four
meaning.
Is this a script I did for loop what it does is of course to define the variable and all the auto date
description modified comments then it's going to run this command last log.
Tail grew up awk these few commands to identify those uses.
Now why am I picking these.
Good question.
First of all last log is the command which will give you all the list of uses that been logged.
You could use the last as well as last log but last log is much efficient for this purpose.
Then tail dash minus two day tail minus and plus 2 meaning get rid of the first line of the output which
I'll show you in a minute what is the first line.
So if I open up a duplicate session log in as root
and if I run last log you will see what is as do more you'll see at the top.
This is the line that comes up that you don't want to get.
So that's why I'm using the option log.
Tell minus and plus two till minus an plus two and just two more again and you'll see that first line
ever showing up is not showing up again.
So that's why I'm using that minus and plus two.
Then next one is grow up.
Test 0.
So now if you wanted to disable those accounts that haven't been logged into the system for 90 days
then you have to use the command.
I believe it's last log minus B 90.
So this will give you all the uses that haven't been logged into the system for the last 90 days.
So you have to remove the pipe right here.
So these are the users that haven't been logged in.
So now you also noticed that there are there are other users that are systems users like route or mail
or operator games or nobody ref ref.
You don't want to get rid of or disable these accounts so you would have to actually make sure that
you put some kind of group inside that removing filtering out some of them and or you could just run
this command and grep it against all the users and see password file and you could actually do grep
for either people who have a home directory or grepped minus fee for those who actually have the user
like no log in.
So let's see if you do cat that's the password you see all the users that are system users are have
no logging.
And the users that actually created an account and log in had this home directory with it.
So you could specify different options different Grupp commands to get rid of those.
But anyway let's let's go back to our command.
This is a command that will give you all the uses that been logged in or have not been logged and put
90 days.
So for my test purposes this lab I created a script can disable user for.
So this script would do is it will actually do the same thing last law but instead of minus B 90 because
again this is a test to show you how to delete the system and how to create a script.
I just removed mine.
B minus 90 kept the tell tale comment and now I'm groping for only test why I'm Grabovica because I
do have a test account in there that I'll show you.
In this exercise if I run it you'll see I had to test the count.
So this command will grow up.
Used to test account and then it will use the command use a mod minus L to disable the account.
So let's try this script again.
And here if you wanted to specify Let's see if you wanted to grow up that minus B minus a not a minus
actually.
And you want to exclude and never.
You could do that and then print out all those years.
But since we're doing the test only to pick the test once and now you'll see this is going to disable
all the test all the accounts that matches test.
So instead of doing 4.
So for now I will use the for command for n the variable $ 8 which is getting from here is putting in
the variable a.
It's doing.
Use a moderate and minus l option is to disable the list and done so instead of just for test.
I will do
cat dollar
for now and I will just put
put comment here so I don't want to delete right now so I will just check what those users.
Run it ups for obsesses no such followed directory.
What happened.
Let's take a look.
For
that log this is what is giving us the entire list of uses and then we're doing is we're putting this
list for an.
I and that oh we not care we don't have to care.
We have to echo
just to see what those girls.
This screen disable uses for loop.
OK.
So here's a list of all the users that have not been logged down but it's still not correct because
I just wanted to test right.
Let's take a look at that disable account for and want to.
Oh I did the minus to exclude I don't want to exclude I want to grep only those because as I said again
this is just for test.
So now let's see and you run it.
It gives me only those uses.
So now I have identified these other uses of God to disable I'll go in and disable use for script.
And this time I will instead of Echo will get rid of that line up put user mode myself and whatever
the user or turn disable them.
Perfect
before I run this script will verify it that I could log in with the use of this going to disable it
was going to say we'll test 1 two three and I'm logging in and you'll see it has logged in perfect.
So now I could get rid of this and now I'll run my script script right now.
Let's say now it should have disable those accounts.
Let's see if I log back in.
Test 1 2 3 in the password and there you go.
So it's not going to let me get in.
It says Access denied.
I know it has disabled those accounts and to verify it will see you could do grep test one just.
Or just test and see shadow.
Shadows the one that actually puts the exclamation point right here.
That would tell that this account should be disable you are here.
So if I just modify that see shadow fall
and look for test I could remove this exclamation point.
And sort of a more excellent point here.
So now I should be able to log back in and to log back in my can my user is Test 1 2 3 and put a password
and bingo i logged it exit out again run again run the command again and it should have logged locked
the count.
Try again
and it's not letting me in X's and perfect.
The script works.
So now this is the one way to disable user account using the for loop and another script I wanted to
show you to do the same thing.
Is this vi as I have created a script for you guys already.
Is X arguments Grip's.
So what is going to do is in Skinner instead of specifying the variable and then running the for loop
and then going through the whole process.
It's going to run the script right here.
Do everything for test and Alk. those.
And instead of that putting into a variable I am actually passing that to as an argument.
I put an X argument and minus I option curly braces meaning whatever comes in as a result from this
command do you mod lock these accounts.
It's just that simple.
So doing the for loop command you can also specify what you wanted to do but the exact same line in
one command.
So let's try it.
Let's try run it but before we run it.
We already have disable those
accounts so I'm going to enable them again by going to see Shatto look for test accounts and get rid
of exclamation point explanation point and save it.
Now when I run this disable X argument it should have disabled those I could verify by doing grep test
on Etsy shadow and you will see it has put that exclamation point in there.
So it's doing the same thing as for LWB doing but it's a different way.
So I have two scripts that you need to learn.
One is cat.
Sorry one is disable four.
And the second one is disable arguments.
So both doing the same thing as you see again if you want to do the test with me you would have to create
test account before using this before doing this exercise.
I actually will actually add that to my video at the beginning by editing it.
But anyway if you if you if you are listening to the message you know already that this message this
lesson has been edited for you to create accounts first which are.
Test one two three or test three four five or whichever account you want to you want to disable and
do your lap for it.