Hi Guys,

First of all apologies if this is in the wrong topic.

I have been given a task of coming up with an approach to identify unix accounts that are no longer in use by the user and applications, and need some ideas to of how to go about this.

These accounts application accounts that can be used by a number of different people via the key logging app powerbroker. I.e every user is null password, login is done via SSH.

Another thing to mention is that we may have accounts on the machine that may not ever be logged on to but may have monthly batch jobs that run automatically and should not be removed.

So I suppose the thing I am getting at is; is there any way to tell easily if an account has been dormant for more than 1 month, (no logins, or processes).

Hopefully I've explained enough, if you have any questions please let me know.

Thanks in advance.

Frank

man wtmp for the first issue.
The second (cron or at jobs) can be handled by simply disallowing interactive logins
to the account via password, invalid shell, or inaccessible home directories.

Thanks ramen.