aging inactive users

["Frank Ch. Eigler" <fche@elastic.org>]

Hi -

Sourceware does not have a mechanical process for aging out hosted
project contributors who have not logged on for a long time.  Given
that projects haven't undertaken this sort of janitorial task, it's
probably time that we put one in place.

A brief shell script scanning ssh authentication logs in
/var/log/secure* spanning a year indicates that only about 1/4 of our
accumulated user base has been active during that time.
(/sourceware/infra/bin/list-ssh-login)

After gathering feedback here, I plan to send a batch of email to
those found not to be active (via their USER@sourceware.org email
addresses).  Then a few weeks later, if they still haven't become
active, I plan to set them to "gid=emeritus" status, so those accounts
can no longer log in.  (This status is easy to reverse if anyone there
is ready to return.)

For administrative/shared accounts, one needs do this analysis on a
per-key basis.  It probably needs to be more recent, considering the
greater privileges of these accounts, say 6 months.  There, a more
manual process to compare ssh-keygen -l lists against the actually
used ssh fingerprints could be used.  That way, we can age out only
those users & keys that have not been used, but preserve others.  I'll
work out another little script for that postprocessing and get it to
note findings via email too.

I propose to repeat this exercise every few months.

Feedback & comments welcome.

- FChE