1 84c190b6 2021-12-17 jrmu #!/usr/bin/perl
 2 84c190b6 2021-12-17 jrmu 
 3 84c190b6 2021-12-17 jrmu package Shell;
 4 84c190b6 2021-12-17 jrmu 
 5 84c190b6 2021-12-17 jrmu use strict;
 6 84c190b6 2021-12-17 jrmu use warnings;
 7 84c190b6 2021-12-17 jrmu use OpenBSD::Pledge;
 8 84c190b6 2021-12-17 jrmu use OpenBSD::Unveil;
 9 84c190b6 2021-12-17 jrmu use Data::Dumper;
10 84c190b6 2021-12-17 jrmu 
11 84c190b6 2021-12-17 jrmu my $authlog = "/var/log/authlog";
12 84c190b6 2021-12-17 jrmu my $etcpasswd = "/etc/master.passwd";
13 84c190b6 2021-12-17 jrmu my @etcpasswd = readarray($etcpasswd);
14 84c190b6 2021-12-17 jrmu my @users;
15 84c190b6 2021-12-17 jrmu foreach my $line (@etcpasswd) {
16 84c190b6 2021-12-17 jrmu 	if ($line =~ /^([^:]+):[^:]+:([^:]+)/) {
17 84c190b6 2021-12-17 jrmu 		my ($username, $uid) = ($1, $2);
18 84c190b6 2021-12-17 jrmu 		if ($uid > 1000) {
19 84c190b6 2021-12-17 jrmu 			push(@users, $username);
20 84c190b6 2021-12-17 jrmu 		}
21 84c190b6 2021-12-17 jrmu 	}
22 84c190b6 2021-12-17 jrmu }
23 84c190b6 2021-12-17 jrmu my @files = ("/var/log/authlog");
24 84c190b6 2021-12-17 jrmu push(@files, glob q("/var/log/authlog.?"));
25 84c190b6 2021-12-17 jrmu push(@files, glob q("/var/log/authlog.1?"));
26 84c190b6 2021-12-17 jrmu foreach my $user (@users) {
27 84c190b6 2021-12-17 jrmu 	my $lastseen;
28 84c190b6 2021-12-17 jrmu 	foreach my $file (@files) {
29 84c190b6 2021-12-17 jrmu 		my @logs = readarray($file);
30 84c190b6 2021-12-17 jrmu 		my @seen = grep(/$user/, @logs);
31 84c190b6 2021-12-17 jrmu 		if (scalar(@seen) && $seen[0] =~ /^(\w+ \d+ \d\d:\d\d:\d\d)/) {
32 84c190b6 2021-12-17 jrmu 			$lastseen = $1;
33 84c190b6 2021-12-17 jrmu 			print "$user => $lastseen\n";
34 84c190b6 2021-12-17 jrmu 			last;
35 84c190b6 2021-12-17 jrmu 		}
36 84c190b6 2021-12-17 jrmu 	}
37 84c190b6 2021-12-17 jrmu 	if (!defined($lastseen)) {
38 84c190b6 2021-12-17 jrmu 		print "$user => Never logged in\n";
39 84c190b6 2021-12-17 jrmu 	}
40 84c190b6 2021-12-17 jrmu }
41 84c190b6 2021-12-17 jrmu #warn Dumper \$loglines[1];
42 84c190b6 2021-12-17 jrmu sub readarray {
43 84c190b6 2021-12-17 jrmu 	my ($filename) = @_;
44 84c190b6 2021-12-17 jrmu 	open(my $fh, '<', $filename) or die "Could not read file '$filename' $!";
45 84c190b6 2021-12-17 jrmu 	chomp(my @lines = <$fh>);
46 84c190b6 2021-12-17 jrmu 	close $fh;
47 84c190b6 2021-12-17 jrmu 	return @lines;
48 84c190b6 2021-12-17 jrmu }