Is it possible to retrieve info regarding to locked unix accouts?I am interested in seeing information about what date and time the lockout happend and from what hostname (pc name). I would like to see something similar to the who command.
How to retrieve information about locked accounts
command line;security;users
I don't believe this information is kept anywhere. They only place you could get some of this type of information would be from the sudo command logs, assuming you're using sudo and that your sudo setup gives out permissions such that you're logging on individual commands such as passwd.I've used this command before to show what accounts are locked,i.e. LK.$ cat /etc/passwd | cut -d : -f 1 | awk '{ system(passwd -S  $0) }'root PS 2010-12-18 0 99999 7 -1 (Password set, SHA512 crypt.)ftp LK 2010-11-11 0 99999 7 -1 (Alternate authentication scheme in use.)nobody LK 2010-11-11 0 99999 7 -1 (Alternate authentication scheme in use.)usbmuxd LK 2010-12-18 0 99999 7 -1 (Password locked.)avahi-autoipd LK 2010-12-18 0 99999 7 -1 (Password locked.)dbus LK 2010-12-18 0 99999 7 -1 (Password locked.)ntop LK 2011-05-22 0 99999 7 -1 (Password locked.)nginx LK 2011-08-19 0 99999 7 -1 (Password locked.)postgres LK 2012-06-26 0 99999 7 -1 (Password locked.)fsniper LK 2012-06-26 0 99999 7 -1 (Password locked.)clamupdate LK 2012-08-31 0 99999 7 -1 (Password locked.)Alternative methodThanks to @RahulPatil in the comments here's a more concise method:$ awk -F: '{ system(passwd -S  $1) }' /etc/passwdroot PS 2007-06-20 0 99999 7 -1 (Password set, MD5 crypt.)bin LK 2007-06-20 0 99999 7 -1 (Alternate authentication scheme in use.)daemon LK 2007-06-20 0 99999 7 -1 (Alternate authentication scheme in use.)adm LK 2007-06-20 0 99999 7 -1 (Alternate authentication scheme in use.)