Is there a non-root shell command that can tell me if a user's account is disabled or not?
Please note that I make a distinction between LOCKING and DISABLED:
- LOCKING is where you prepend
!!to the password field of the /etc/passwd or /etc/shadow file. Password locking can be done (at a shell prompt) via
password -l username(as root) to lock the account of username, and the use of the option
-uwill unlock it.
- DISABLING an account is done by setting the expiration time of the user account to some point in the past. This can be done with
chage -E 0 username, which sets the expiration date to 0 days after the Unix epoch. Setting it to
-1will disable the use of the expiration date.
For my situation, the use of locking is not sufficient because a user might still be able to login, e.g. using ssh authentication tokens, and processes under that user can still spawn other processes. Thus, we have accounts that are enabled or disabled, not just locked. What I'm looking for is a way to check the enable/disable status of an account via a shell command, for use in a custom Java process. The Java process can parse the output or make use of the exit code, and it can execute complicated statements such as those including pipes between commands.
This is intended for use on a Red Hat Enterprise 5.4 system.
This question was previously asked on SuperUser.