Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking to have Linux user account expire 7 days after the user logs in. Is there any solution aside from a custom-written script which checks and updates user accounts?

I have already looked at chage, /etc/login.defs, etc. Those tools allow you set set expiration based on the current date. I don't want the expiration count-down to begin until after the user has logged in for the first time.

share|improve this question
    
Why do you want to do this? What is the business need that is being satisfied? I ask because your question looks lot like an XY problem. –  MadHatter Jun 6 at 17:56
    
@MadHatter Perhaps. Our users are given shell accounts which expire after 7 days, but many do not log in right away. As an admin, it would be most convenient to generate their account and send it to them right away. Users expect the account to be valid for 7 days after they log in, not 7 days after account creation. –  i_grok Jun 7 at 20:08
    
I take your point. But, assuming there's a security benefit to having the accounts expire after seven days (your call), why is that benefit not deemed to start until they log in? What problem are you trying to fix, here? –  MadHatter Jun 8 at 0:38
    
It's not a question of security, but of total time allotted on the server. The business need is for users to have a maximum of 7 days on the system. –  i_grok Jun 8 at 0:46
    
Then it seems the question of "starting when" is entirely a business, and not a technical, issue. Tell them they get seven days from now, and if they choose not to log in, that's their own problem. –  MadHatter Jun 8 at 1:08

1 Answer 1

up vote 4 down vote accepted

I really think you need a bit of scripting to do this. You could make it straightforward, by putting a special file in the users home directory, when the account is created e.g. .firsttime - then use this as a flag as to whether the user has logged in.

Then in the system-wide login profile, you test for the existence of the file, if its there, you could then touch a file in a root-owned directory with sticky-bit set and no execute (this would be to prevent users from seeing the file), and then remove the original file.

three lines of script added to /etc/profile.d e.g

if [ -e ~/.firsttime ]
then
  touch /tmp/firsttime/$USER
  rm ~/.firsttime
fi

then a cron script, or manual script could set expire on the accounts listed. I would put a check in to make sure the ownership and filename match, to prevent someone from putting a "root" file there.

share|improve this answer
    
For anyone who comes back to this solution, the correct permissions for the /tmp/firsttime directory should be set with: chmod 1773 /tmp/firsttime –  i_grok Jun 30 at 13:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.