Is there a non-root shell command that can tell me if a user's account is disabled or not?
Please note that there is a fine distinction between LOCKING and DISABLED:
- LOCKING is where you prepend
!or*or!!to the password field of the /etc/passwd file. On Linux systems that shadow the passwords, this marker flag may be placed in /etc/shadow instead of /etc/passwd. Password locking can be done (at a shell prompt) viapassword -l username(as root) to lock the account of username, and the use of the option-uwill unlock it. - DISABLING an account is done by setting the expiration time of the user account to some point in the past. This can be done with
chage -E 0 username, which sets the expiration date to 0 days after the Unix epoch. Setting it to -1 will disable the use of the expiration date.
The effect of locking to to prevent the login process from using a supplied password to hash correctly against the saved hash (by virtue of the fact that the pre-pended marker character(s) are not valid output character(s) for the hash, thus no possible input can ever be used to generate a hash that would match it). The effect of disabling is to prevent any process from using an account because the expiration date of the account has already passed.
For my situation, the use of locking is not sufficient because a user might still be able to login, e.g. using ssh authentication tokens, and processes under that user can still spawn other processes. Thus, we have accounts that are enabled or disabled, not just locked. We already know how to disable and enable the account - it requires root access and the use of chage, as shown above.
To repeat my question: is there a shell command which can be run without root privileges which can output the status of this account expiration info for a given user?
If it helps any, this is intended for use on a Red Hat Enterprise 5.4 system. The output is being returned to a java process which can then parse the output as needed, or make use of the return code.
