[hobbit] inactive user accounts

You might try:

•      using a custom script to run "last" command (or parse

  lastlog, depending on your OS)

•      compare output of above to field #1 in the etc/passwd file

  (possibly using "diff" or similarr command)

•      alert on those names that show up in the output of the above

  step

www.deadcat.net <http://www.deadcat.net/> has a few scripts that do almost what you're thinking of, they should be pretty straightforward to modify.

Dean Casey

From: Ryan Jay B. Lapuz [mailto:rlapuz at fcpp.fujitsu.com] Sent: Friday, August 10, 2007 6:26 AM To: hobbit at hswn.dk Subject: [hobbit] inactive user accounts

Hi everyone!

Does Hobbit supports monitoring of behavior of user/email accounts like if the account has been inactive for 30 days?

If not, can someone give me any idea on how to do it?

Thanks in advance

Regards

Ryan