asked on

students failing to run keylogin get locked out of their accounts once global read access of the password table is disabled

I have inherited a set of nis+ systems, which I think has not been properly configured. My own nis+ knowledge is not sufficient yet to solve the dilemma.

currently the passwd.org_dir table is gloabally readable - not a good thing. If I restrict read access with a nistbladm -u passwd=w-r passwd.org_dir then users who have neglected to run keylogin and change their passwords get locked out and I have to jump through hoops to change their password and then do a chkey -p

How can I tell if a user has run keylogin. If I could generate a list of those who have not run keylogin I could figure out which accounts I have to fix. FYI rather a lot, 4K+, of accounts..

liddler

Can't you either tell all users to run keylogin or put it into everyone's .profile, so it run's the next time they login and the deletes itself from their .profile
i.e.
something like:
for file in ls /home/*/.profile
do
cp .profile .profile.sav
echo keylogin >> .profile
echo mv .profile.sav .profile >> .profile
done

AlastairNeil

ASKER

There has been a message in the motd for weeks instructing everyone to keylogin and change passwords, however students being students a percentage of them will ignore it and a percentage of them will not access their account until they actually need to work on a project.

Putting keylogin in the .profile does not really address my problem, I could easily wrap keylogin in a script that logs the uid of those running it, but I want to find those that have already run it, or more importantly those that have not run it yet.

ASKER CERTIFIED SOLUTION

modulo

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial