Set Linux user account expiration after user logs in

Question

I'm looking to have Linux user account expire 7 days after the user logs in. Is there any solution aside from a custom-written script which checks and updates user accounts?

I have already looked at chage, /etc/login.defs, etc. Those tools allow you set set expiration based on the current date. I don't want the expiration count-down to begin until after the user has logged in for the first time.

Answer 1

I really think you need a bit of scripting to do this. You could make it straightforward, by putting a special file in the users home directory, when the account is created e.g. .firsttime - then use this as a flag as to whether the user has logged in.

Then in the system-wide login profile, you test for the existence of the file, if its there, you could then touch a file in a root-owned directory with sticky-bit set and no execute (this would be to prevent users from seeing the file), and then remove the original file.

three lines of script added to /etc/profile.d e.g

if [ -e ~/.firsttime ]
then
  touch /tmp/firsttime/$USER
  rm ~/.firsttime
fi

then a cron script, or manual script could set expire on the accounts listed. I would put a check in to make sure the ownership and filename match, to prevent someone from putting a "root" file there.