API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Nov 29th, 2018
186
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.84 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl -w
  2. BEGIN { ($_pathname,$_filename)=($0=~m#(.*)/([^/]+)$#)?($1,$2):(".",$0); push @INC,$_pathname; };
  3.  
  4. sub usage {
  5. ################################################################
  6. #
  7. # Title : report-passwdfile.pl
  8. #
  9. # Author : Damien Farah/Andy Thom
  10. #
  11. # Description :
  12. print STDERR "\nERROR: $_[0]\nUsage:\n", <<"EndOfDescription";
  13.  
  14. $_filename <host> [ <host> ... ]
  15.  
  16. EndOfDescription
  17. #
  18. # SCCS Version:
  19. #
  20. # History : 04Jun12 Damien - birth.
  21. #
  22. #################################################################
  23. exit 2;
  24. }
  25.  
  26. #
  27. # Internal Variables
  28. ####################
  29. $| = 1; # No buffering STDOUT;
  30. my( $SSHCMD ) = "/usr/bin/ssh -t -o PreferredAuthentications=hostbased";
  31. my( $HOSTNAME ) = qx{/bin/hostname}; chop $HOSTNAME;
  32. # The "our" is required to import variables from the BEGIN above.
  33. our( $_pathname, $_filename );
  34. # If the ControlM environment is set, use the variables in our email.
  35. my( $CONTROLM ) = $ENV{CTM_SCHEDTAB}?"***\nRun by ControlM:\n----------------\nSchedTable: $ENV{CTM_SCHEDTAB}\nJobname/Memname: $ENV{CTM_JOBNAME}/$ENV{CTM_MEMNAME}\n":"";
  36.  
  37.  
  38. #
  39. # Required Libraries
  40. ####################
  41. use strict;
  42. use Parallel;
  43.  
  44. #
  45. # Global Constants/Variables
  46. ############################
  47. #my( $EMAIL_TOLIST ) = "Damien.Farah\@bis.org";
  48. my( $EMAIL_TOLIST ) = "service.unix\@bis.org";
  49. #my( $EMAIL_TOLIST ) = "Mark.Gahan\@bis.org";
  50. my( $EMAIL_SUBJECT ) = "Linux Password File Check Report";
  51. my @MSG = "Please find below the output of the password check script which summarises the password issues found for each Linux server.";
  52.  
  53.  
  54. ##################################################################
  55. # Define the stub
  56. ##################################################################
  57. # Here we define the stub code. It is a piece of generic code that
  58. # runs on every server. It essentially decodes (base64) stdin
  59. # into a file which it then runs. In this way we can pass our
  60. # scripts through via stdin.
  61. my( $STUB ) = q{/usr/bin/perl -MMIME::Base64 -e '
  62. foreach ( @ARGV ) {
  63. s%([\\\"])%\\\\$&%go; # Quote \\s and "s
  64. $scriptargs .= qq{"$_" };
  65. }
  66. $scriptargs =~ s%([\\\"])%\\\\$&%go; # Quote \\s and "s
  67. my( $tmpscript ) = "/tmp/_monitor$$";
  68. local $/ = undef;
  69. if ( open(SCRIPT, ">$tmpscript") ) {
  70. chmod 0700, "$tmpscript";
  71. print SCRIPT decode_base64(<STDIN>);
  72.  
  73. # Execute the temporary file - then remove it.
  74. exec qq{sh -c "$tmpscript $scriptargs; #rm -rf $tmpscript"};
  75.  
  76. print stderr "ERROR: Failed executing command : $!\n";
  77. } else {
  78. print stderr "ERROR: Failed creating temporary file : $!\n";
  79. }
  80. exit 1; # If we got here then we had an error.
  81. ' -- };
  82.  
  83.  
  84. ##################################################################
  85. # Main
  86. ##################################################################
  87. usage "Arguments expected." if ( ! @ARGV );
  88. my( @hosts );
  89. my( $scriptargs ) = "";
  90. #MG added stuff...
  91. if ( $ARGV[0] eq '-r' ) {
  92. ( $scriptargs ) = "-r";
  93. shift (@ARGV);
  94. } else {
  95. my( $scriptargs ) = "";
  96. }
  97. my( $hostsflg ) = 1;
  98. foreach ( @ARGV ) {
  99. if ( /^\-\-$/o ) {
  100. $hostsflg = 0;
  101. } elsif ( $hostsflg ) {
  102. push @hosts, $_;
  103. } else {
  104. s%([\034"])%\\$&%g; # Quote \\s and "s
  105. $scriptargs .= qq{"$_" };
  106. }
  107. }
  108. usage "Please identify the hosts to run on." if ( ! @hosts );
  109.  
  110. my( @email );
  111. my( %output );
  112. # Create a Parallel object to run our ssh's in parallel.
  113. my( $run ) = new Parallel(
  114. 'timeout' => 10,
  115. 'parallel' => 5,
  116. 'cball' => sub {
  117. my( $i, @stdout ) = @_;
  118. @{$output{$i}->{'stdout'}} = @stdout if ( @stdout );
  119. },
  120. 'cberrall' => sub {
  121. my( $i, @stderr ) = @_;
  122. @stderr = grep( !/^(#\|#|Inappropriate ioctl|Connection to \S+ closed.|Pseudo-terminal will not be allocated)/o, @stderr );
  123. @{$output{$i}->{'stderr'}} = @stderr if ( @stderr );
  124. },
  125. 'cbend' => sub {
  126. my( $i, $rc ) = @_;
  127. if ( exists $output{$i} || $rc > 0 ) {
  128. local $, = "\n";
  129. push @email, "***********************************************************";
  130. push @email, "* ${hosts[$i]}";
  131. push @email, "***********************************************************";
  132. push @email, @{$output{$i}->{'stdout'}} if ( $output{$i}->{'stdout'} );
  133. if ( exists $output{$i}->{'stderr'} ) {
  134. push @email, "************************* stderr **************************";
  135. push @email, @{$output{$i}->{'stderr'}};
  136. }
  137. if ( $rc > 0 ) {
  138. my( $exitcode, $signal ) = (($rc>>8),($rc&0x0f));
  139. push @email, "\nexitcode=$exitcode - signal=$signal";
  140. }
  141. push @email, "\n\n";
  142. }
  143. },
  144. );
  145.  
  146. { # We run inside a block so that we can define local variables.
  147. use MIME::Base64;
  148. local $/ = undef;
  149. my( $script ) = encode_base64( <DATA> );
  150. $scriptargs =~ s%([\\"])%\\$1%g; # Quote \\s and "s
  151. $run->run( map { qq{echo "$script" |$SSHCMD $_ "$STUB $scriptargs" } } @hosts );
  152. }
  153.  
  154.  
  155. # If the output array has content, then email it appropriately.
  156. if ( @email && ( $scriptargs eq '-r' ) ) {
  157. my $bodyrep = <<'BLOCKEND';
  158. !! ATTENTION ACTION NEEDED !!
  159.  
  160. You are being sent this email because you are listed as the owner or contact for one or more application accounts on the system(s) listed please review the relevant accounts in the Accounts for Review section below, in particular review the following:
  161.  
  162.  
  163. 1. Is the account still neeeded - If not indicate which accounts can be removed
  164. 2. Is the account owner/contact correct - If not indicate who is the correct contact for which account
  165.  
  166.  
  167. You can respond with a reply to this Email to the IMS/Unix team - service.unix&san@bis.org
  168.  
  169. The Format of the report below is : <APPLICATION ACCOUNT>:<ACCOUNT OWNER(s) EMAIL DETAILS>:<ACCOUNT DESCRIPTION IF AVAILABLE>
  170.  
  171.  
  172. Regards,
  173.  
  174.  
  175. UNIX Team
  176.  
  177. ACCOUNTS FOR REVIEW ARE AS FOLLOWS
  178. ######################################
  179. BLOCKEND
  180.  
  181. # Copy the array to a new one
  182. my @copy_email = @email ;
  183. @email = "";
  184. my @elist = map { split(/:/, $_) } @copy_email;
  185. my @elist_multi_split = map { split(/,/, $_) } @elist;
  186. my @elist_mails = grep( /\@/, @elist_multi_split );
  187. my @lc_elist_mails = map { lc } @elist_mails;
  188. my @unique_elist = do { my %seen; grep { !$seen{$_}++ } @lc_elist_mails };
  189. my $email_addr = "" ;
  190. my ( @user_rep );
  191. my ( @user_items );
  192. foreach $email_addr (@unique_elist){
  193. #@user_rep = "";
  194. my @form_email = grep ( /$email_addr/i, @copy_email) ;
  195. # Get the lists of hosts the user has accounts for then foreach them
  196. my @hlist = map { (split /:/, $_)[-1] } @form_email;
  197. my @unique_hlist = do { my %seen; grep { !$seen{$_}++ } @hlist };
  198. foreach my $hlist_item (@unique_hlist) {
  199. push @user_rep, "*************************************************************";
  200. push @user_rep, "***************** Linux Server-$hlist_item ******************";
  201. push @user_rep, "*************************************************************";
  202. @user_items = grep ( /$hlist_item/, @form_email) ;
  203. my @clean_user_items = map {s/\:$hlist_item//g; $_; } @user_items;
  204. push @user_rep, @clean_user_items ;
  205. push @user_rep, " ";
  206. push @user_rep, " ";
  207. # Improvement idea Do the final formatting to niceify the report
  208. }
  209. open(MAIL,"|/usr/sbin/sendmail -t");
  210. print MAIL "To: $email_addr\n";
  211. #print MAIL "To: Mark.Gahan\@bis.org\n";
  212. print MAIL "Cc: Mark.Gahan\@bis.org\n";
  213. print MAIL "From: service.unix&san\@bis.org\n";
  214. print MAIL "Subject: Non Expiring Linux Application Account review - The following Linux accounts must be reviewed\n";
  215. print MAIL "$bodyrep";
  216. print MAIL join("\n", @user_rep), "\n";
  217. #print MAIL @user_rep;
  218. close MAIL;
  219. #print "sending mail to $email_addr\n";
  220. push @email, "Email sent to $email_addr\n";
  221. @user_rep = "";
  222. }
  223. # Zero the email array for a clean exit
  224. #@email = ();
  225. @MSG = "The password check script was executed in report mode, the following have been mailed the non-expiring application account review request:";
  226. }
  227. # If the output array has content, then email it appropriately.
  228. if ( @email ) {
  229. $"="\n";
  230. my( $hostlist ) = join(" ",@hosts);
  231. if (open(MAILX, qq{| /usr/sbin/sendmail -f "$_filename" $EMAIL_TOLIST})) {
  232. print MAILX <<"EOMAIL";
  233. To: $EMAIL_TOLIST
  234. Subject: $EMAIL_SUBJECT
  235.  
  236. Hello :-)
  237.  
  238. @MSG
  239.  
  240. @email
  241.  
  242.  
  243. ==========================================
  244. This script [ ${HOSTNAME}:$_pathname/$_filename ]
  245. Run on host(s) [ $hostlist ]
  246.  
  247. $CONTROLM
  248. EOMAIL
  249. close MAILX;
  250. }
  251. }
  252.  
  253.  
  254. __DATA__
  255. #!/bin/bash
  256. #####
  257. # passwordCheck2.sh
  258. #
  259. #
  260. # Description
  261. # ===========
  262. # This script will check the status of users passwords and send a Email to
  263. # the user is one of the following condtions is met:-
  264. #
  265. # (MG) Updated to V2.00 10-09-2015 To meet audit requirements for better control of ignore lists
  266. # Split the ignore list into system and app and added a reporting feature for yearly
  267. # App ignore list reviews
  268. #
  269. # - entry missing in /etc/shadow for user(s)
  270. #
  271. # - is the account locked (added: 28-02-2012)
  272. #
  273. # - empty password.
  274. #
  275. # - password has expired.
  276. #
  277. # - password change is overdue.
  278. #
  279. # - the password change warning period has been reached.
  280. #
  281. #
  282. #
  283.  
  284. declare -i verboseMode=0
  285. declare -i testMode=0
  286. if [[ $1 == "-v" ]]; then
  287. verboseMode=1
  288. elif [[ $1 == "-t" ]]; then
  289. testMode=1
  290. elif [[ $1 == "-r" ]]; then
  291. reportMode=1
  292. fi
  293.  
  294.  
  295. declare -r myHostname=$(hostname --fqdn)
  296. declare -r myshortHostname=$(uname -n)
  297.  
  298. #
  299. #####
  300. # Fields used in /etc/shadow
  301. #
  302. # 0 - UID
  303. # 1 - password
  304. # 2 - DAYS SINCE LAST CHANGE (since EPOCH)
  305. # 3 - days between changes (default 2)
  306. # 4 - MUST CHANGE AFTER x DAYS (default 60)
  307. # 5 - WARN x DAYS BEFORE EXPIRY (defualt 7)
  308. # 6 - DAYS AFTER PASSWORD EXPIRES THAT ACCOUNT IS DISABLED (default NULL)
  309. # 7 - DAYS SINCE EPOCH THAT ACCOUNT IS DISABLED (default NULL)
  310. #
  311. #
  312. declare -r UID_Shadow=0
  313. declare -r password_Shadow=1
  314. declare -r lastChange_Shadow=2
  315. declare -r mustChange_Shadow=4
  316. declare -r warnDate_Shadow=5
  317. declare -r expireDate_Shadow=7
  318.  
  319.  
  320.  
  321. declare -r secondsPerDay=86400
  322.  
  323. declare -i userID_Min=$(grep UID_MIN /etc/login.defs | tr "[:space:]" " " | tr -s " "|cut -f2 -d" ")
  324. declare -i userID_Max=$(grep UID_MAX /etc/login.defs | tr "[:space:]" " " | tr -s " "|cut -f2 -d" ")
  325. declare -i daysSinceEpoch=$(($(/bin/date +%s)/$secondsPerDay))
  326.  
  327.  
  328. #
  329. #-----------------------------------------------------------------------------
  330. # Variables for Email
  331. #
  332. #
  333. #declare adminEmailAddress="service.unix@bis.org"
  334. declare adminEmailAddress="mark.gahan@bis.org"
  335. declare CorpsecEmailAddress="Corporate.Security@bis.org"
  336. #declare CorpsecEmailAddress="Mark.Gahan@bis.org"
  337.  
  338. [[ ${testMode} -eq 1 ]] && adminEmailAddress="andy.thom@bis.org"
  339.  
  340. declare -r adminEmailSubject="Password Issues for $myHostname"
  341. declare adminEmailBody="Here is a summary of password issues: ...
  342.  
  343.  
  344. "
  345. declare -i sendAdminEmail=0
  346.  
  347.  
  348.  
  349. declare -r lockedSubject='WARNING: Your account for user: $currentUser on $myHostname is locked'
  350. declare -r lockedBody='!! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !!
  351.  
  352.  
  353. Your account for user: $currentUser on $myHostname has been locked.
  354.  
  355.  
  356.  
  357. If you require your account unlocked or would like to have the account
  358. REMOVED please contact the IT Service Desk (8008) or contact a member of
  359. the IMS/Unix team - service.unix@bis.org.
  360.  
  361.  
  362.  
  363. Regards,
  364.  
  365.  
  366. UNIX Team
  367.  
  368. '
  369.  
  370.  
  371. declare -r emptySubject='WARNING: User: $currentUser on $myHostname has a EMPTY password'
  372. declare -r emptyBody='!! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !!
  373.  
  374.  
  375. Your password for user: $currentUser on $myHostname is EMPTY.
  376.  
  377. Please create a password for this user immediately or it WILL be disabled.
  378.  
  379.  
  380. If you have any issues changing your password please contact the IT Service
  381. Desk (8008) or contact a member of the IMS/Unix team - service.unix@bis.org.
  382.  
  383.  
  384.  
  385. Regards,
  386.  
  387.  
  388. UNIX Team
  389.  
  390. '
  391.  
  392.  
  393. declare -r expiredSubject='WARNING: Your password has expired: $currentUser on $myHostname'
  394. declare -r expiredBody='!! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !!
  395.  
  396.  
  397. Your password for user: $currentUser on $myHostname has expired.
  398.  
  399. Please change your password immediately or it may be disabled.
  400.  
  401.  
  402. If you have any issues changing your password please contact the IT Service
  403. Desk (8008) or contact a member of the IMS/Unix team - service.unix@bis.org.
  404.  
  405.  
  406.  
  407. Regards,
  408.  
  409.  
  410. UNIX Team
  411.  
  412. '
  413.  
  414.  
  415. declare -r warnSubject='WARNING: Your password for: $currentUser on $myHostname will expire in $passwordTimeLeft'
  416. declare -r warnBody='!! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !!
  417.  
  418.  
  419. Your password for user: $currentUser on $myHostname will expire soon.
  420.  
  421. Please change your password with-in the next $passwordTimeLeft days or it may be disabled.
  422.  
  423.  
  424. If you have any issues changing your password please contact the IT Service
  425. Desk (8008) or contact a member of the IMS/Unix team - service.unix@bis.org.
  426.  
  427.  
  428.  
  429. Regards,
  430.  
  431.  
  432. UNIX Team
  433.  
  434. '
  435.  
  436.  
  437. declare -r overdueSubject='WARNING: You MUST change your password for: $currentUser on $myHostname will expire in $passwordTimeLeft'
  438. declare -r overdueBody='!! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !!
  439.  
  440.  
  441. You are now $passwordOverdueDays days overdue changing your password for user:-
  442.  
  443. $currentUser on $myHostname.
  444.  
  445.  
  446. Please change your password IMMEDIATELY or it may be disabled.
  447.  
  448.  
  449. If you have any issues changing your password please contact the IT Service
  450. Desk (8008) or contact a member of the IMS/Unix team - service.unix@bis.org.
  451.  
  452.  
  453.  
  454. Regards,
  455.  
  456.  
  457. UNIX Team
  458.  
  459. '
  460.  
  461. declare -r ReportSubject='Non Expiring Linux Application Account review: The System : $myHostname has the following Application accounts for review'
  462. declare ReportAppwarnBody='!! ATTENTION ACTION NEEDED !!
  463.  
  464. You are being sent this email because you are listed as the owner or contact for one or more application accounts on the system please review the relevant accounts in the Accounts for Review section below, in particular review the following:
  465.  
  466.  
  467. 1. Is the account still neeeded - If not indicate which accounts can be removed
  468. 2. Is the account owner/contact correct - If not indicate who is the correct contact for which account on which system
  469.  
  470.  
  471. You can respond with a reply to this Email to the IMS/Unix team - service.unix&san@bis.org
  472.  
  473.  
  474. Regards,
  475.  
  476.  
  477. UNIX Team
  478.  
  479. ACCOUNTS FOR REVIEW PER LINUX SERVER ARE AS FOLLOWS
  480. ##########################################################
  481. '
  482. declare -r MissAppwarnSubject='WARNING: The Linux application account : $sysUser on $myHostname No Longer exists on the system'
  483. declare -r MisssyswarnSubject='WARNING: The Linux system account : $sysUser on $myHostname No Longer exists on the system'
  484. declare -r MissAppwarnBody="!! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !!
  485.  
  486. The Application account has been removed from this system but has been left in the application password check exclude list
  487. If the account is no longer required please contact the IMS/Unix team - service.unix@bis.org to have the account removed from the exclude list on this syetsm
  488.  
  489.  
  490.  
  491.  
  492. Regards,
  493.  
  494.  
  495. UNIX Team
  496. "
  497.  
  498.  
  499. declare -r MissSyswarnBody="!! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !! WARNING !!
  500.  
  501. The System account has been removed from this system but has been left in the system password check exclude list
  502. If the account is no longer required please contact the IMS/Unix team - service.unix@bis.org to have the account removed from the exclude list on this syetsm
  503.  
  504.  
  505.  
  506.  
  507. Regards,
  508.  
  509.  
  510. UNIX Team
  511. "
  512.  
  513.  
  514.  
  515. declare eMailSubject=""
  516. declare eMailBody=""
  517. declare eMailFrom='unix&san"," service <service.unix&san@bis.org>'
  518. declare -i sendEmail=0
  519.  
  520. declare -r ignoreListFile="/opt/biz/etc/system_account.list"
  521. declare -r ignoreListFile_App="/opt/biz/etc/application_account.list"
  522.  
  523. # In case the new files are not there..
  524. # Make use of the perl wrapper to echo the info and exit this host..
  525. #
  526. if [ ! -e $ignoreListFile ] || [ ! -e $ignoreListFile_App ];then
  527. echo Exclude files are missing on this system no checks or reports perfromed please ensure the audit-users.sh script has been executed on this host....
  528. exit 0
  529. fi
  530.  
  531. # Get the users in those lists
  532. declare -r ignoreListAdmin=$(/bin/grep -v ^# $ignoreListFile)
  533. declare -r ignoreListApp=$(/bin/grep -v ^# $ignoreListFile_App | awk -F: '{print $1}')
  534.  
  535. #
  536. #
  537. #-----------------------------------------------------------------------------
  538. #
  539.  
  540.  
  541. if [[ $verboseMode -eq 1 ]];then
  542. printf "UserID Min: [%d]\n" ${userID_Min}
  543. printf "UserID Max: [%d]\n" ${userID_Max}
  544. printf "Total Days: [%d]\n" ${daysSinceEpoch}
  545. fi
  546.  
  547.  
  548. #
  549. #####
  550. # Get the list of users with-in the MIN and MAX UID range ...
  551. #
  552. #
  553. declare -a userList=$(/usr/bin/awk -F: -v uidField=3 -v unameField=1 \
  554. -v uidMin=${userID_Min} -v uidMax=${userID_Max} \
  555. -- '$uidField>=uidMin && $uidField<=uidMax \
  556. {print $unameField}' /etc/passwd)
  557. #
  558. #####
  559. # Get the full list of users needed for checking missing users against ignore lists
  560. #
  561. #
  562. declare -a userList_Full=$(/usr/bin/awk -F: -v unameField=1 -- '{print $unameField}' /etc/passwd)
  563.  
  564.  
  565. declare -i ignoreUsers=0
  566. declare -i checkCount=0
  567. declare tempString=""
  568.  
  569.  
  570. #
  571. #####
  572. # Simple reporting and exit section for reporting of application users on the app ignore list...
  573. # to application owners - Typicly executed yearly
  574. #
  575.  
  576. if [[ $reportMode -eq 1 ]]; then
  577.  
  578. RepAppmailList=$(grep -v ^# $ignoreListFile_App | awk -F: '{print $2}' | tr ',' '\n' | sort | uniq | tr '\n' ',')
  579. if [[ -z $RepAppmailList ]]; then
  580. echo "No Application accounts to report on exiting..."
  581. exit 0
  582. fi
  583. #RepAppmailList=$(grep -v ^# $ignoreListFile_App | awk -F: '{print $2}' | tr ',' '\n' | sort | uniq | tr '\n' ',')
  584. RepUserlist=$(grep -v ^# $ignoreListFile_App)
  585. RepeMailSubject=$(eval "echo \"$ReportSubject\"")
  586. ReportAppwarnBody="${ReportAppwarnBody}\n${RepUserlist}"
  587. # echo -e "$ReportAppwarnBody" | /bin/mailx -s "$RepeMailSubject" -S from="$eMailFrom" $RepAppmailList
  588. echo -e " "
  589. declare item=""
  590. for item in $(grep -v ^# $ignoreListFile_App)
  591. do
  592. repuser=$(echo $item | cut -f1 -d":")
  593. repuser_email=$(echo $item | cut -f2 -d":")
  594. repuser_info=$(grep -w ^$repuser /etc/passwd | cut -f5 -d":" |sed -e 's/ /_/g')
  595. echo "$item:$repuser_info:$myHostname"
  596.  
  597. done
  598. exit 0
  599. fi
  600.  
  601.  
  602. #
  603. #####
  604. # Check that all listd account names in the ignore files are accounts
  605. # that exist first check the systems then the app accounts
  606. # and also check the existing accounts in the lists are expiring
  607.  
  608.  
  609. for sysUser in $ignoreListAdmin; do
  610. MissSysUser=$(echo $userList_Full | /bin/grep -cw $sysUser)
  611. if [[ $MissSysUser -lt 1 ]]; then
  612. tempString=$(printf "\t%-15s: user is in the system ignore list but does not exist on the system, please investigate..." ${sysUser})
  613. adminEmailBody="${adminEmailBody}\n${tempString}"
  614. # Then send a mail to Corpsec to inform them of the removed user..
  615. EV_MisssyswarnSubject=$(eval "echo \"$MisssyswarnSubject\"")
  616. # echo -e "$MissSyswarnBody" | /bin/mailx -s "$EV_MisssyswarnSubject" $CorpsecEmailAddress
  617. (( sendAdminEmail++ ))
  618. fi
  619.  
  620. if [[ $MissSysUser -eq 1 ]]; then
  621. chkSysPassExp=$(chage -l $sysUser | grep -w "Password expires" | grep -cw "never")
  622. if [[ ${chkSysPassExp} -lt 1 ]]; then
  623. tempString=$(printf "\t%-15s: user in the system ignore list and has an expiring password , please investigate..." ${sysUser})
  624. adminEmailBody="${adminEmailBody}\n${tempString}"
  625. (( sendAdminEmail++ ))
  626. fi
  627. fi
  628. done
  629.  
  630.  
  631. for sysUser in $ignoreListApp; do
  632. MissAppUser=$(echo $userList_Full | /bin/grep -cw $sysUser)
  633. if [[ $MissAppUser -lt 1 ]]; then
  634. MissAppEmail=$(grep $sysUser $ignoreListFile_App | awk -F: '{print $2}')
  635. tempString=$(printf "\t%-15s: user is in the Application ignore list but does not exist on the system, please remove the user from the exclude list if no longer required..." ${sysUser})
  636. adminEmailBody="${adminEmailBody}\n${tempString}"
  637. EV_MissAppwarnSubject=$(eval "echo \"$MissAppwarnSubject\"")
  638. echo -e "$MissAppwarnBody" | /bin/mailx -s "$EV_MissAppwarnSubject" $MissAppEmail
  639. (( sendAdminEmail++ ))
  640. fi
  641.  
  642. if [[ $MissAppUser -eq 1 ]]; then
  643. chkAppPassExp=$(chage -l $sysUser | grep -w "Password expires" | grep -cw "never")
  644. if [[ ${chkAppPassExp} -lt 1 ]]; then
  645. tempString=$(printf "\t%-15s: user in the application ignore list has an expiring password , please investigate..." ${sysUser})
  646. adminEmailBody="${adminEmailBody}\n${tempString}"
  647. (( sendAdminEmail++ ))
  648. fi
  649. fi
  650. done
  651.  
  652.  
  653. #
  654. #####
  655. # Process the list of users and check for expiring password ...
  656. #
  657. #
  658. declare -r oldIFS=${IFS}
  659.  
  660.  
  661. for currentUser in $userList_Full; do
  662. ignoreUser=$(($(/bin/grep -cw $currentUser $ignoreListFile)))
  663. ignoreUser_App=$(($(/bin/grep -cw $currentUser $ignoreListFile_App)))
  664.  
  665.  
  666. declare userInfo=$(grep ^${currentUser} /etc/passwd | cut -f5 -d":")
  667.  
  668. if [[ $ignoreUser -ge 1 ]]; then
  669. # Commented out the verbose reporting of ignores we just count them and report
  670. # [[ $verboseMode -eq 1 ]] && printf "Ignoring User: [%s]\n" ${currentUser}
  671.  
  672. # tempString=$(printf "\t%-15s: user is in the System ignore list - no action taken." ${currentUser})
  673. # adminEmailBody="${adminEmailBody}\n${tempString}"
  674.  
  675. # if [[ ${userInfo} ]]; then
  676. # tempString=`printf "\t (%s)" "${userInfo}"`
  677. # adminEmailBody="${adminEmailBody}\n${tempString}\n"
  678. # fi
  679. (( ignoreUsers++ ))
  680.  
  681. elif [[ $ignoreUser_App -ge 1 ]]; then
  682. # [[ $verboseMode -eq 1 ]] && printf "Ignoring Application User: [%s]\n" ${currentUser}
  683.  
  684.  
  685. # tempString=$(printf "\t%-15s: user is in the Application ignore list - no action taken." ${currentUser})
  686. # adminEmailBody="${adminEmailBody}\n${tempString}"
  687.  
  688. # if [[ ${userInfo} ]]; then
  689. # tempString=`printf "\t (%s)" "${userInfo}"`
  690. # adminEmailBody="${adminEmailBody}\n${tempString}\n"
  691. # fi
  692. (( ignoreUsers++ ))
  693.  
  694. else
  695.  
  696. (( checkCount++ ))
  697.  
  698. IFS=":"
  699. declare -a userShadow=($(/bin/grep -w ^$currentUser /etc/shadow))
  700. IFS=${oldIFS}
  701.  
  702. if [[ $verboseMode -eq 1 ]]; then
  703. printf "+++ Shadow User: [%s]\n\tPassword Date:[%d] Must Change: [%d] Warn: [%d] Expire Date:[%d]\n" ${userShadow[UID_Shadow]} \
  704. ${userShadow[lastChange_Shadow]} \
  705. ${userShadow[mustChange_Shadow]} \
  706. ${userShadow[warnDate_Shadow]} \
  707. ${userShadow[expireDate_Shadow]}
  708. fi
  709.  
  710.  
  711. #
  712. #####
  713. # 1 - Check there is actually a entry in /etc/shadow for the user
  714. #
  715. #
  716. if [[ ${#userShadow[*]} -eq 0 ]]; then
  717. (( sendAdminEmail++ ))
  718.  
  719. [[ ${verboseMode} -eq 1 ]] && printf "\t*** NO ENTRY IN /etc/shadow for: [%s]\n" ${currentUser}
  720.  
  721.  
  722. tempString=`printf "*\t%-15s: URGENT! USER HAS NO ENTRY IN /etc/shadow - PLEASE FIX ASAP.\n" ${currentUser}`
  723. adminEmailBody="${adminEmailBody}\n${tempString}"
  724.  
  725. if [[ ${userInfo} ]]; then
  726. tempString=`printf "\t (%s)" "${userInfo}"`
  727. adminEmailBody="${adminEmailBody}\n${tempString}\n"
  728. fi
  729.  
  730. else
  731. declare -i nextChangeDate=${userShadow[lastChange_Shadow]}+${userShadow[mustChange_Shadow]}
  732. declare -i passwordOverdueDays=${daysSinceEpoch}-${userShadow[lastChange_Shadow]}-${userShadow[mustChange_Shadow]}
  733.  
  734. declare -i passwordTimeLeft=${nextChangeDate}-${daysSinceEpoch}
  735.  
  736. declare -i passwordLocked=$(passwd -S ${currentUser}|cut -f2 -d" " |grep -c "LK")
  737.  
  738.  
  739. [[ ${verboseMode} -eq 1 ]] && printf "\tUser: [%s]\n\tNext Change Date: [%d]\n\tTime Left: [%d]\n\tWarn Time: [%d]\n\tOverdue: [%d]\n" ${currentUser} ${nextChangeDate} ${passwordTimeLeft} ${userShadow[warnDate_Shadow]} ${passwordOverdueDays}
  740.  
  741.  
  742. [[ ${verboseMode} -eq 1 ]] && printf "Password Time Left........: [%d]\n" ${passwordTimeLeft}
  743.  
  744.  
  745. #
  746. #####
  747. # 6 - Check if the account is locked.
  748. #
  749. #
  750. if [[ ${passwordLocked} -eq 1 ]]; then
  751. sendEmail=1
  752. (( sendAdminEmail++ ))
  753. [[ ${verboseMode} -eq 1 ]] && printf "\t*** Sending LOCKED PASSWORD Email for: [%s]\n" ${currentUser}
  754.  
  755. eMailSubject=$(eval "echo \"$lockedSubject\"")
  756. eMailBody=$(eval "echo \"$lockedBody\"")
  757.  
  758. tempString=`printf "\t%-15s: account is locked.\n" ${currentUser}`
  759. adminEmailBody="${adminEmailBody}\n${tempString}"
  760.  
  761.  
  762. #
  763. #####
  764. # 2 - Check for EMPTY password
  765. #
  766. #
  767. elif [[ -z ${userShadow[password_Shadow]} ]]; then
  768. sendEmail=1
  769. (( sendAdminEmail++ ))
  770.  
  771.  
  772. [[ ${verboseMode} -eq 1 ]] && printf "\t*** Sending EMPTY PASSWORD Email for: [%s]\n" ${currentUser}
  773.  
  774. eMailSubject=$(eval "echo \"$emptySubject\"")
  775. eMailBody=$(eval "echo \"$emptyBody\"")
  776.  
  777. tempString=`printf "\t%-15s: has a EMPTY password - sending email." ${currentUser}`
  778. adminEmailBody="${adminEmailBody}\n${tempString}\n"
  779.  
  780.  
  781. #
  782. #####
  783. # 3 - Check if the password is expired
  784. #
  785. #
  786. elif [[ ${userShadow[expireDate_Shadow]} -ne 0 && \
  787. ${userShadow[expireDate_Shadow]} -le ${daysSinceEpoch} ]]; then
  788. sendEmail=1
  789. (( sendAdminEmail++ ))
  790.  
  791.  
  792. [[ ${verboseMode} -eq 1 ]] && printf "\t*** Sending EXPIRE Email for: [%s]\n" ${currentUser}
  793.  
  794. eMailSubject=$(eval "echo \"$expiredSubject\"")
  795. eMailBody=$(eval "echo \"$expiredBody\"")
  796.  
  797. tempString=`printf "\t%-15s: password has expired - sending email." ${currentUser}`
  798. adminEmailBody="${adminEmailBody}\n${tempString}\n"
  799.  
  800.  
  801. #
  802. #####
  803. # 4 - Check if the password is overdue for a change
  804. #
  805. #
  806. elif [[ ${passwordOverdueDays} -gt 0 ]]; then
  807. sendEmail=1
  808. (( sendAdminEmail++ ))
  809. [[ ${verboseMode} -eq 1 ]] && printf "\t*** Sending OVERDUE Email for: [%s]\n" ${currentUser}
  810.  
  811. eMailSubject=$(eval "echo \"$overdueSubject\"")
  812. eMailBody=$(eval "echo \"$overdueBody\"")
  813.  
  814. tempString=`printf "\t%-15s: password overdue by %02d days for changing - sending email." ${currentUser} ${passwordOverdueDays}`
  815. adminEmailBody="${adminEmailBody}\n${tempString}\n"
  816.  
  817.  
  818. #
  819. #####
  820. # 5 - Check if the password is with-in the warning period
  821. #
  822. #
  823. elif [[ ${passwordTimeLeft} -le ${userShadow[warnDate_Shadow]} ]]; then
  824. sendEmail=1
  825. (( sendAdminEmail++ ))
  826. [[ ${verboseMode} -eq 1 ]] && printf "\t*** Sending WARNING Email for: [%s]\n" ${currentUser}
  827.  
  828. eMailSubject=$(eval "echo \"$warnSubject\"")
  829. eMailBody=$(eval "echo \"$warnBody\"")
  830.  
  831. tempString=`printf "\t%-15s: password will expire in %02d days - sending email." ${currentUser} ${passwordTimeLeft}`
  832. adminEmailBody="${adminEmailBody}\n${tempString}\n"
  833. fi
  834. fi
  835.  
  836. fi
  837.  
  838.  
  839. #
  840. #####
  841. # Send a Email to the user if required ...
  842. #
  843. #
  844. if [[ ${testMode} -eq 0 && ${sendEmail} -eq 1 ]]; then
  845. # printf "SENDING EMAIL TO: [%s]\n\n" ${currentUser}
  846. echo -e "$eMailBody" | /bin/mailx -s "$eMailSubject" ${currentUser}@bis.org
  847. # echo -e "$eMailBody" | /bin/mailx -s "$eMailSubject for ${currentUser}" Mark.Gahan@bis.org
  848. sendEmail=0
  849. fi
  850. done
  851.  
  852.  
  853.  
  854. #
  855. #####
  856. # Send an Email to the ADMIN user(s) if required ...
  857. #
  858. #
  859. if [[ $sendAdminEmail -ge 1 ]]; then
  860. #
  861. #####
  862. # Create a summary for the ADMIN Email ...
  863. #
  864. #
  865. # printf "SENDING ADMIN EMAIL\n\n"
  866. adminEmailBody=$(echo -e ${adminEmailBody}) # To translate \n chars.
  867. cat <<-EOMAIL
  868.  
  869. ${adminEmailBody}
  870.  
  871. Summary:-
  872. =======
  873.  
  874. Total Users Ignored: ${ignoreUsers}
  875. Total Users Checked: ${checkCount}
  876. Total Issues.......: ${sendAdminEmail}
  877.  
  878. Ignored System Users listed in: ${ignoreListFile}
  879.  
  880. Ignored Application Users listed in ${ignoreListFile_App}
  881.  
  882. EOMAIL
  883. # echo -e "$adminEmailBody" | /bin/mailx -s "$adminEmailSubject" ${adminEmailAddress}
  884. fi
  885.  
  886.  
  887. #
  888. #####
  889. # Send back a valid return code - just incase this is used in Control-M
  890. #
  891. #
  892. exit 0
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!