RHEL 9 fleet tooling · over SSH

linux-users

Audit accounts, sudoers, and SSH keys across the fleet, then retire the stale ones. Locks and expires. Never deletes.

$ git clone https://github.com/vikozs/linux-users

lfu.kosir.info — example run

linux-users discover -H hosts.txt -u sa.vko --ask-ssh-pass --sudo-pass-same-as-ssh
web01.zav-mb.loc         12 accounts  3 stale  8 issues
db01.zav-mb.loc           4 accounts  0 stale  0 issues
Plan:   users_plan.json
Report: users_report.xlsx
Totals: 16 accounts, 3 stale, 8 issues, 1 weak key

How it works

discover

accounts, sudoers, keys, last login

review

read the stale candidates

apply

lock or expire, re-validated live

What it does

Real staleness

Stale means a login account past your last-login threshold. Accounts whose last login is unknown or never are never auto-locked.

Can't lock you out

root, UID < 1000, the account you connect as, and any --protect names are excluded and re-checked at apply time.

Finds the sharp edges

Duplicate UID 0, empty passwords, never-expiring passwords, NOPASSWD sudo, and weak ssh-dss keys.

Never deletes

apply only locks and optionally expires. No userdel, no key removal, no sudoers edits. Shadow hashes are never collected.

Output

A report you can hand to anyone

A formatted Excel workbook plus a machine-readable JSON plan. Sheets:

SummaryAccountsStale CandidatesSudoersSSH KeysIssuesErrorsAbout

Safety

GUARDED

apply only locks or expires, re-validating last login first. Protected accounts can never enter the apply set.

The rest of the family

linux-auditlinux-patchlinux-certslinux-userslinux-driftlinux-firewalllinux-applylinux-diskspace