Shell Programming and Scripting

Was wondering if any had a script to change the last login field within the /etc/shadow? Need to it run against machines to "reset" the last login so local accounts will not expire if account isn't access within the mandatory setting we are force to implement.

Thanks!!!!

Hi.

Question: If you can (i.e. are able to) modify such a thing, and in doing so, circumvent the policy "you are forced to implement", why can't you just circumvent the policy by not implementing it in the first place?

We are forced to have the accounts expire after 60 days. I want a script that I can run to change the last change date on accounts that are not used very often. example: run the script for the local accounts to have last change date become yesterday.

Logging in does not write to the shadow file.

Record keeping of "last login" varies according to your Operating System and it is not always installed by default.
What Operating System do you have?


BTW. As hinted above, most Administrators would exclude non-user accounts (e.g. "oracle" or whatever) from such a policy because of the complex issues with automated tasks when the password expires.

our system accounts are excluded from the policy but we have local accounts that are subject to the policy. OS are Sol9 & 10, SUSE and Red Hat.

So why not exclude the local accounts that you need too?
I'm assuming that this is an audit requirement and you have to show that the policy is in effect, ie. passwords are set to expire after X days, when someone looks at your system but in reality, you're not abiding by it fully.

I've been there and it's usually easier to get an exception for those users that require it than to write whatever scripting is necessary to catch them all, or if it's a manual thing, to set your calendar to remind you to do it. Eventually, it will catch you and an automated process will fail because of an expired password.

Good luck.