summaryrefslogtreecommitdiff
path: root/localnotifypwexp
blob: dc8a096c3685af4f79842fa7444e277c6360f726 (plain)
  1. #!/bin/bash
  2. set -e
  3. # notifypwexp - send mail to users whose passwords are expiring soon
  4. # designed to be run daily or weekly from cron
  5. # call with -w for weekly mode (checks to see if warning period begins in the next 7 days
  6. # use -w for a weekly cron job, avoiding excessive emails
  7. # with no option, it only checks whether we're in the warning period now
  8. # use this for a daily cron job
  9. # by Dennis Williamson
  10. # Origin: http://serverfault.com/questions/11887
  11. # ### SETUP ###
  12. if [[ $1 == "-w" ]] # check for expiration warnings beginning during the next seven days
  13. then
  14. weekmode=7
  15. else
  16. weekmode=0
  17. fi
  18. admins="root postmaster"
  19. declare -r aged=21 # minimum days after expiration before admins are emailed, set to 0 for "always"
  20. hostname=$(hostname --fqdn)
  21. domainname=$(hostname --domain)
  22. # fields in shadow file (system dependent)
  23. declare -r last=2
  24. #declare -r may=3 # not used in this script
  25. declare -r must=4
  26. declare -r warn=5
  27. #declare -r grace=6 # not used in this script
  28. declare -r disable=7
  29. declare -r doesntmust=99999
  30. declare -r warndefault=7
  31. # fields in passwd file
  32. declare -r uidfield=3
  33. declare -r unamefield=1
  34. # UID range is system dependent
  35. declare -r uidmin=1000
  36. declare -r uidmax=65534 # exclusive
  37. # mailx is system dependent
  38. notifyprog="mailx"
  39. awkprog="awk"
  40. dateprog="date"
  41. # comment out one of these
  42. #useUTC=""
  43. useUTC="-u"
  44. # +%s is a GNUism - set it to blank and use dateformat if you have
  45. # a system that uses something else like epochdays, for example
  46. epochseconds="+%s"
  47. dateformat="" # blank for GNU when epochseconds="+%s"
  48. secondsperday=86400 # set this to 1 for no division
  49. today=$(($($dateprog $useUTC $epochseconds $dateformat)/secondsperday))
  50. oIFS=$IFS
  51. # ### END SETUP ###
  52. # ### MAIL TEMPLATES ###
  53. # use single quotes around templates, backslash escapes and substitutions
  54. # will be evaluated upon output
  55. usersubjecttemplate='Your password is expiring soon'
  56. userbodytemplate='Your password on $hostname expires in $((expdate - today)) days.
  57. More help is available at http://support.$domainname/password'
  58. adminsubjecttemplate='User Password Expired: $user@$hostname'
  59. adminbodytemplate='The password for user $user on $hostname expired $age days ago.
  60. Please contact this user about their inactive account and consider whether
  61. the account should be disabled or deleted.'
  62. # ### END MAIL TEMPLATES ###
  63. # allow overrides (especially userbodytemplate)
  64. declare -r orgconfig=local-ORG/notifypwexp
  65. declare -r hostconfig=local/notifypwexp
  66. [ ! -r /etc/$orgconfig ] || . /etc/$orgconfig
  67. [ ! -r /etc/$hostconfig ] || . /etc/$hostconfig
  68. # get real users
  69. users=$(getent passwd | $awkprog -F: -v uidfield=$uidfield \
  70. -v unamefield=$unamefield \
  71. -v uidmin=$uidmin \
  72. -v uidmax=$uidmax \
  73. -- '$uidfield>=uidmin && $uidfield<uidmax \
  74. {print $unamefield}')
  75. for user in $users;
  76. do
  77. IFS=":"
  78. usershadow=$(getent shadow "$user")
  79. # make an array out of it
  80. usershadow=($usershadow)
  81. IFS=$oIFS
  82. mustchange=${usershadow[$must]}
  83. disabledate=${usershadow[$disable]:-$doesntmust}
  84. # skip users that aren't expiring or that are disabled
  85. if [[ $mustchange -ge $doesntmust || $disabledate -le $today ]] ; then continue; fi;
  86. lastchange=${usershadow[$last]}
  87. warndays=${usershadow[$warn]:-$warndefault}
  88. expdate=$((lastchange + mustchange))
  89. threshhold=$((today + warndays + weekmode))
  90. if [[ $expdate -lt $threshhold ]];
  91. then
  92. if [[ $expdate -ge $today ]];
  93. then
  94. subject=$(eval "echo \"$usersubjecttemplate\"")
  95. body=$(eval "echo \"$userbodytemplate\"")
  96. echo -e "$body" | $notifyprog -s "$subject" "$user"
  97. else
  98. if [[ $age -ge $aged ]];
  99. then
  100. subject=$(eval "echo \"$adminsubjecttemplate\"")
  101. body=$(eval "echo \"$adminbodytemplate\"")
  102. echo -e "$body" | $notifyprog -s "$subject" $admins
  103. fi
  104. fi
  105. fi
  106. done