From: fietze@kagcpd01.ag01.kodak.COM (Roman Fietze@kagcpd01.ag01.kodak.COM,KAG CP Development@kagcpd01.ag01.kodak.COM, 49 711 406 2839)
Newsgroups: biz.sco.general
Subject: Re: SCO Unix V/386 3.2.2 C2, Remove lines from /etc/passwd?
Date: 24 Dec 92 14:26:43 GMT
Reply-To: fietze@kagcpd01.ag01.kodak.COM
Organization: Kodak AG, Office Imaging, Product Engineering and Development
Resent-From: mmdf@xenitec.on.ca
Submit-To: scogen@xenitec.on.ca
Cc: scogen@xenitec.on.ca
Return-Receipt-To: fietze@kagcpd01.ag01.kodak.COM
Precedence: bulk

Hello John,

> I have SCO Unix 3.2.2 installed w/ security enabled.  Id like to remove
> entries from /etc/passwd.  Is it possible without screwing up the protected
> databases?  I can easily disable the accounts, but there are several of them
> and I'm someone who cares about aesthetics.

Try to get UNX257. This update includes the file rmuser(ADM) (as well
as some others), which allows you to remove a user account from the
system.

--- cut here ---
     RMUSER(ADM)                          UNIX System V

     Name
          rmuser, rmgroup, rmpasswd - remove user accounts

     Syntax
          /tcb/bin/rmuser users

     Description
          rmuser removes user accounts from the system. A user account
          consists of a line in /etc/passwd, entries in /etc/group and
          a protected password  database  file.   rmuser  removes  all
          three entities from the system.

          If no users are specified on the command  line  then  rmuser
          will read standard input for account names, one per line.

          rmuser checks there are no currently running  processes  for
          the account before removing it.

          rmuser uses  ale(ADM)  and  two  underlying  shell  scripts,
          rmpasswd   and   rmgroup   to  do  the  actual  removal  and
          authck(ADM) to rebuild the  subsystem  databases.   ale  and
          authck  require the invoking user to have the auth subsystem
          authorization   and   the   chown   and   execsuid    kernel
          authorizations.

     Files
          /etc/passwd                        password file

          /etc/group                         group file

          /tcb/files/auth/?/*                protected        password
          database

          /tcb/lib/auth_scripts/rmpasswd     user script

          tcb/lib/auth_scripts/rmgroup       group script

     See Also
          ale(ADM), passwdupd(ADM), authcap(F)

     Diagnostics
          rmuser returns an exit status of 1 if it was interrupted

     Notes
          Because removing users is not allowed on a C2 system, rmuser
          checks  that the system has been relaxed before removing any
          accounts.

          rmuser does not  remove  all  traces  of  an  account:  home
          directories  are  left intact, any cron jobs are not removed
          and the name of the account is left in the Terminal  Control
          database  and  some  Protected  Password  entries.   In  the
          Terminal Control database, the deleted account name  is  not
          removed  from the last (un)successful login, and last logout
          fields of a  terminal  entry.   In  the  Protected  Password
          entries,  the  account  name  is  left in the owner field of
          accounts which the removed account owned, and  the  password
          user field of any accounts for which the removed account was
          authorized to change the password.  These remnants in the C2
          database files do not affect the system.

     Value Added
          rmuser is an extension of AT&T  System  V  provided  by  the
          Santa Cruz Operation.

     (printed 12/11/90)                               RMUSER(ADM)
--- cut here ---

Hope that helps,

Roman

---------------------------------------------------------------------
Roman Fietze (Mail Code 2201)                    Hedelfinger Str. 154
Copier and Printer Development                      7000 Stuttgart 60
Kodak AG                                                      Germany
fietze@kagcpd01.ag01.kodak.COM                  VOICE 49-711-406-2839
fietze@kodak.COM                                    K-NET 28-631-2839