01
2021-12-17
jrmu
#!/usr/bin/perl
03
2021-12-17
jrmu
package Shell;
05
2021-12-17
jrmu
use strict;
06
2021-12-17
jrmu
use warnings;
07
2021-12-17
jrmu
use OpenBSD::Pledge;
08
2021-12-17
jrmu
use OpenBSD::Unveil;
09
2021-12-17
jrmu
use Data::Dumper;
11
2021-12-17
jrmu
my $authlog = "/var/log/authlog";
12
2021-12-17
jrmu
my $etcpasswd = "/etc/master.passwd";
13
2021-12-17
jrmu
my @etcpasswd = readarray($etcpasswd);
14
2021-12-17
jrmu
my @users;
15
2021-12-17
jrmu
foreach my $line (@etcpasswd) {
16
2021-12-17
jrmu
if ($line =~ /^([^:]+):[^:]+:([^:]+)/) {
17
2021-12-17
jrmu
my ($username, $uid) = ($1, $2);
18
2021-12-17
jrmu
if ($uid > 1000) {
19
2021-12-17
jrmu
push(@users, $username);
23
2021-12-17
jrmu
my @files = ("/var/log/authlog");
24
2021-12-17
jrmu
push(@files, glob q("/var/log/authlog.?"));
25
2021-12-17
jrmu
push(@files, glob q("/var/log/authlog.1?"));
26
2021-12-17
jrmu
foreach my $user (@users) {
27
2021-12-17
jrmu
my $lastseen;
28
2021-12-17
jrmu
foreach my $file (@files) {
29
2021-12-17
jrmu
my @logs = readarray($file);
30
2021-12-17
jrmu
my @seen = grep(/$user/, @logs);
31
2021-12-17
jrmu
if (scalar(@seen) && $seen[0] =~ /^(\w+ \d+ \d\d:\d\d:\d\d)/) {
32
2021-12-17
jrmu
$lastseen = $1;
33
2021-12-17
jrmu
print "$user => $lastseen\n";
37
2021-12-17
jrmu
if (!defined($lastseen)) {
38
2021-12-17
jrmu
print "$user => Never logged in\n";
41
2021-12-17
jrmu
#warn Dumper \$loglines[1];
42
2021-12-17
jrmu
sub readarray {
43
2021-12-17
jrmu
my ($filename) = @_;
44
2021-12-17
jrmu
open(my $fh, '<', $filename) or die "Could not read file '$filename' $!";
45
2021-12-17
jrmu
chomp(my @lines = <$fh>);
46
2021-12-17
jrmu
close $fh;
47
2021-12-17
jrmu
return @lines;
