Unix / Solaris Password Expiration Automated email notification

I have been entrusted with setting up a mail alert system for user password expiration. The user should automatically get intimated through mail a few days before his password expiration date. I wrote a small script by taking help from www.unix.com and other forums.
Below is the script for checking the age of the password and alert the user if password is going to expire in next 15 days.

Script Name  :- /usr/bin/solchage

---script start here----
#!/usr/bin/bash
umask 0022
PATH=/usr/bin:/usr/sbin
SHADOW=/etc/shadow
DSHADOW=/etc/shadow.dummy
USER=$1

# Copy the contents of /etc/shadow to a dummy file and make sure the entries for system  
# users are not there in the dummy file. Also replace the encrypted password field with      
# *LK* to make sure passwords are not visible or cannot be copied by someone else.

cat ${SHADOW} | egrep -v "root|daemon|etc" | awk -F: '{print $1,"*LK*",$3,$4,$5,$6,$7,$8}' | sed 's/ /:/g' > ${DSHADOW}

PASSWDFILE=/etc/passwd

# Specify the mail domain of your company here.
DOMAIN=xyz.com

# The next line extracts the users email id from GECOS field of /etc/passwd file. So as a pre # requisite to running this script, you must enter the email id of the user, without the            # domain name, in GECOS field as i have assumed here. Let me know if you can think of a
# more elegant way of extracting this information.

EMAIL=`grep ^${USER} ${PASSWDFILE} | awk -F: '{print $5}'`

# Save the message in a file.
FILE=/tmp/msg.$$

# Set the password policy here, i.e the number of days after which user must change              # password.
PWPOLICY=90
# Set the warning period here.
WARN=15

# Calculate the number of seconds elapsed since Jan 1 ,1970 i.e Unix epoch.

EPOCH=`perl -e 'print time;'`

# Convert the number of seconds into days.

DAYSEPOCH=`expr ${EPOCH} / 86400`

# Calculate the number of days since password was changed for the last time for a particular # user. This info can be extracted from 3rd field of /etc/passwd file. This is expressed as
# the number of days between January 1,  1970, and  the  date  that  the  password was last
# modified.

LASTCHG=`grep ^${USER} ${DSHADOW} | awk -F: '{print $3}'`


# Subtract the above value from the number of days since epoch to arrive at the number    #  of days since last password change. 

PASSWDCHANGE=`expr ${DAYSEPOCH} - ${LASTCHG}`

EXPIRED=`expr ${PWPOLICY} - ${PASSWDCHANGE}`

if [ "${EXPIRED}" -lt "${WARN}" ]; then

cat > ${FILE} <<EOF
Dear ${USER},
Your password will expire in ${EXPIRED} days. Please change it as soon as possible.
EOF

mailx -s "Password expiring soon." ${EMAIL}@${DOMAIN} < ${FILE}

fi--- script end here---

To run the above main script, you have to run another small script which i produce below.
Copy the above script and place it under /usr/bin and name it solchage. Ofcourse you can give it another name, its upto you but make corresponding changes in below script as well if you do so.

Lets name the second script as /var/pwexpire.sh. So put this script in crontab for execution once everyday. It will run for all users, and send them a mail if their password is going to expire within 15 days.

Script Name:- /var/pwexpire.sh

--- script begin here ---

cat /etc/passwd | egrep -v "root|daemon|etc|sys|adm|lp|uucp|nuucp|smmsp|listen|gdm|webservd|postgres|svctag|nobody|noaccess|nobody4" | awk -F: '{print $1}' | egrep -v "bin" | xargs -I {} /usr/bin/solchage {}

---script end here---


What the above script does ? Let us examine step by step.

1) It reads /etc/passwd file and cuts out system users from the list
2) Then prints the remaining usernames using awk and removes all other entries except first filed from the output.
3) Then xargs executes our script /usr/bin/solchage one by one for every listed user. This is required because the our script takes username as argument ( see USER=$1 above ) and runs for that particular user.

You will have to give execute permissions to both the scripts.

Disabling sendmail daemon (SMTP) on solaris 10

The sendmail daemon runs on port 25 and is enable by default on solaris boxes.
The sendmail daemon is not needed to be running on servers which are meant to be mail clients. To disable sendmail service use below steps:-

1. Edit /etc/default/sendmail . Create the file if its not already there and include the following values:
MODE=Ac
QUEUEINTERVAL=”15m”

2. Stop the sendmail service 
/etc/init.d/sendmail stop

3. Now edit /etc/sendmail/submit.cf

and change the line shown here: D{MTAHost}[127.0.0.1]
to :
D{MTAHost}[<ur-mail-server-ip>]

4.  Start the sendmail service.
    /etc/init.d/sendmail start

Now port 25 on localhost would be disabled and server wont be listening on that port anymore.

Sendmail with To, Cc , Bcc fields and subject ,message body etc

Sendmail is a pretty old mail interface and hence sending mail with all fields like Subject, Body and Content using sendmail is a bit tedious. I have seen users sometime getting frustrated with sendmail because they do not know how to use it properly and utilize its full features. They come to unix admin for help in sorting out their issues. In this post i will show how to add To, Cc , Bcc fields and subject / message body in the sendmail message. I will share a trick to get sendmail working as desired.

First create a sendmail.txt file with below contents :-

*********************************************************************************

From: root@pnc.com
To: abhi@xyz.com
Cc: nlm@xyz.com
Date: echo "`date`"
Subject: HELLO
Mime-Version: 1.0
Content-Type: text

Write the message body here , this is the mail content.  

*********************************************************************************

The above plain text file contains all the desired fields. Most important part is the Content-Type declaration. 

Then run the below command from unix prompt

# cat sendmail.txt | /usr/lib/sendmail -t 

The -t option of sendmail as per manpages

     -t          Read message for recipients.  To:, Cc:, and Bcc: lines will
                 be scanned for recipient addresses.  The Bcc: line will be
                 deleted before transmission.

The above command simply takes input for sendmail command from the text file we just created. Once you send the mail you can see all fields are visible and sendmail works as per your requirement. Do let me know if you face any issue in running sendmail with these options.

 

   

svcadm enhancements in Solaris 10 - Bind to localhost

Some services in solaris 10 operate based on local and global properties.

For example, in rpcbind configuration if the value for local_only is set to true, all rpc services are accessible from inside the machine but an outside machine cannot access these services.

bash-3.00# svccfg -s rpc/bind listprop config/local_only

config/local_only  boolean  false

bash-3.00#

bash-3.00# svccfg -s rpc/bind setprop config/local_only=true

bash-3.00#

bash-3.00# svcadm refresh rpc/bind

bash-3.00#

bash-3.00# svccfg -s rpc/bind listprop config/local_only

config/local_only  boolean  true

bash-3.00#

bash-3.00# svccfg -s rpc/bind setprop config/local_only=false

bash-3.00#

bash-3.00# svcadm refresh rpc/bind

bash-3.00# svcadm refresh rpc/bind

bash-3.00#

bash-3.00# svccfg -s rpc/bind listprop config/local_only

config/local_only  boolean  false

This in my opinion is a significant security enhancement, especially in some cases where you want a particular service to be accessible from localhost but disabled for outside machines. Many solaris services have this kind of configurability.

Two files with same name in a directory !!!

Have you ever seen two files with same name inside a directory ? Is it possible at all ? What if a user shows you this, right in front of your eyes ?

Actually, it is impossible to have two files of the same name in a directory,unix does not permit this. If at all such behaviour is observed, then one of the files must have control characters in its name!! and it simply means these are 2 different files and so must have different inode numbers.

Check the different inode numbers of the files with below command.

# ls -lib           -----> this command will show inode number and any control characters in the filename.

The man page for ls says that –b will ……

List nonprinting characters in the octal \ddd notation

Once we have the inode number ( in the example below i am using 2460 as inode number), we can easily use find command to move the dubious file to a safe location and delete it there.

# find / -xdev -inum 2460 -exec mv {} /tmp/wastebin/ \;

# rm –rf /tmp/wastebin