chage

bbm · 5. Februar 2018

In my OMV I have n shares (share1;share2; share3 )take for example share1 it is r/w with user1;user2 and r for user3 and forbidden for user4

I need to change user password monthly for all user that is related to a network share

My idea is to
1) chage manually on all user that has a share
2) create a script that mail them that they have only 5 days to change password
3) lock account past 10 days without change the password

Is this a good idea or it can be accomplished in a better ways

If this is a good idea
1) is simple
2) what are the rule to write the script and run it via cron or anacron and send emails without fight with OMV mailer.
2b)The idea is to point the user to standard OMV login so he/she can change the password by themself.
3)If locked only root can unlock it

subzero79 · 6. Februar 2018

Please read here

https://linux.die.net/man/5/shadow

All of that can be scripted, if you need to send notifications use the postfix backend

http://openmediavault.readthed…ations.html#configuration

The frontend does not provide a field for password expiry so this has to be set manually after each user is created, unfortunately there is no post script hook or environmental variable to control this.

bbm · 7. Februar 2018

Ok Perfect thanks
I'll try and post my solution.

Bash

#!/bin/bash
# My first script
#find all users in group users


USERGROUP="$(grep 'users' /etc/group)"
#echo "${USERGROUP}"


IFS=':' read -ra TKN<<< "${USERGROUP}"
#for i in "${TKN[@]}"; do
#    echo "${i}"
#done


GROUP_NAME=${TKN[0]}
PWD=${TKN[1]}
GID=${TKN[2]}
USERLIST=${TKN[3]}


#echo "${LIST}"
UINFO=""
IFS=',' read -ra users<<< "${USERLIST}"
for i in "${users[@]}"; do
    #echo "${i}"
    USERINFO="$(grep "${i}" /etc/shadow)"
    #echo "${USERINFO}"

    IFS=':' read -ra TKN1<<< "${USERINFO}"
    #for j in "${TKN1[@]}"; do
    #    echo "${j}"
    #done


    LOGINNAME=${TKN1[0]}
    PWD=${TKN1[1]}
    #The date of the last password change, expressed as the number of days since Jan 1, 1970    
    LASTCHANGE=${TKN1[2]}
    #The minimum password age is the number of days the user will have to wait before she will be allowed to change her password again.    
    MINAGE=${TKN1[3]}
    #The maximum password age is the number of days after which the user will have to change her password.
    #After this number of days is elapsed, the password may still be valid. The user should be asked to change her password the next time she will log in.
    MAXAGE=${TKN1[4]}
    #The number of days before a password is going to expire (see the maximum password age above) during which the user should be warned.
    WRNPERIOD=${TKN1[5]}
    #The number of days after a password has expired (see the maximum password age above) during which the password should still be accepted (and the user should update her password during the next login).
    PWDPPERIOD=${TKN1[6]}
    #The date of expiration of the account, expressed as the number of days since Jan 1, 1970.
    EXPDATE=${TKN1[7]}


    #echo "LOGINNAME=${TKN1[0]}"
    #echo "PWD=${TKN1[1]}"
    #echo "LASTCHANGE=${TKN1[2]}"
    #echo "MINAGE=${TKN1[3]}"
    #echo "MAXAGE=${TKN1[4]}"
    #echo "WRNPERIOD=${TKN1[5]}"
    #echo "PWDPPERIOD=${TKN1[6]}"
    #echo "EXPDATE=${TKN1[7]}"


    # echo $(($(date --utc --date "$1" +%s)/86400))
    # echo "LASTCHANGE=${TKN1[2]}"


   
    LASTCAHANGESEC=$((${LASTCHANGE}*86400))
    MAXAGESEC=$((${MAXAGE}*86400))
    WARNPERIODSEC=$((${WRNPERIOD}*86400))
    NOWSEC=$(($(date --utc --date "$1" +%s)))


    WRNLIMITSEC=$((${LASTCAHANGESEC}+${MAXAGESEC}-${WARNPERIODSEC}))    
    CHANGELIMITSEC=$((${LASTCAHANGESEC}+${MAXAGESEC}))


    DISTANCESEC=$((${NOWSEC}-${CHANGELIMITSEC}))
    DISTANCEDAY=$((${DISTANCESEC}/86400))


    #echo "${NOWSEC}"
    #echo "${LASTCAHANGESEC}"
    #echo "${MAXAGESEC}"
    #echo "${WARNPERIODSEC}"
    #echo "${WRNLIMITSEC}"
    #echo "${CHANGELIMITSEC}"


    #echo "${DISTANCEDAY}"
    IPS="$(hostname --all-ip-addresses)"
    #echo ${IPS}


    UINFO="${UINFO}"$'\n'"User:${LOGINNAME} - [${DISTANCEDAY}]"




    if [ ${NOWSEC} -gt ${WRNLIMITSEC} ]
    then
        if [ ${NOWSEC} -gt ${CHANGELIMITSEC} ]
	then
		DISTANCEDAY=$((${DISTANCESEC}/86400))
		#echo "EXPIRED FROM ${DISTANCEDAY} DAY"
		echo "$(date) PWD for user: ${LOGINNAME} is expired from ${DISTANCEDAY} days." | mail -s "Password expired" ${LOGINNAME}
	else
	    	DISTANCEDAY=$((${DISTANCESEC}/-86400))
		#echo "GOING TO EXPIRE ${DISTANCEDAY} DAY"
                echo "$(date) PWD for user: ${LOGINNAME} will expire in ${DISTANCEDAY} days." | mail -s "Password expire" ${LOGINNAME}
	fi
    fi
done
   echo "User control: $(date) ${UINFO}" | mail -s "User Control" root
   logger -p local7.info "User Control Executed: $(date) ${UINFO}"

Alles anzeigen

Jetzt mitmachen!