How to suppress su authentication failure warning?

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
0
down vote

favorite












I created an account "diag" and set it as expired (usermod --expiredate 1). Then I have a script which I want to run to log into it, so in the script I use the following command:



su -s /bin/bash - diag


This outputs like so:



Your account has expired; please contact your system administrator
su: Authentication failure
(Ignored)
diag@computer:~$


And then I'm able to use the account, as expected.



I want to suppress the first three lines, the warning about the expired account. I tried adding 2> /dev/null to the end of the command, but that suppresses all the output from bash; I just get a blank response, and I can type commands into it and see the result from them, but I see no bash prompt. I tried adding just > /dev/null and that does nothing.



So I've deduced that apparently su is piping all its output over stderr. How can I get su to just suppress those first three lines, but otherwise act normally as if the account weren't expired?










share|improve this question





















  • What exactly are you trying to do? Beware the XY problem.
    – terdon
    Oct 4 '12 at 17:29











  • I am trying to open a bash prompt for an expired user.
    – Ricket
    Oct 4 '12 at 17:32














up vote
0
down vote

favorite












I created an account "diag" and set it as expired (usermod --expiredate 1). Then I have a script which I want to run to log into it, so in the script I use the following command:



su -s /bin/bash - diag


This outputs like so:



Your account has expired; please contact your system administrator
su: Authentication failure
(Ignored)
diag@computer:~$


And then I'm able to use the account, as expected.



I want to suppress the first three lines, the warning about the expired account. I tried adding 2> /dev/null to the end of the command, but that suppresses all the output from bash; I just get a blank response, and I can type commands into it and see the result from them, but I see no bash prompt. I tried adding just > /dev/null and that does nothing.



So I've deduced that apparently su is piping all its output over stderr. How can I get su to just suppress those first three lines, but otherwise act normally as if the account weren't expired?










share|improve this question





















  • What exactly are you trying to do? Beware the XY problem.
    – terdon
    Oct 4 '12 at 17:29











  • I am trying to open a bash prompt for an expired user.
    – Ricket
    Oct 4 '12 at 17:32












up vote
0
down vote

favorite









up vote
0
down vote

favorite











I created an account "diag" and set it as expired (usermod --expiredate 1). Then I have a script which I want to run to log into it, so in the script I use the following command:



su -s /bin/bash - diag


This outputs like so:



Your account has expired; please contact your system administrator
su: Authentication failure
(Ignored)
diag@computer:~$


And then I'm able to use the account, as expected.



I want to suppress the first three lines, the warning about the expired account. I tried adding 2> /dev/null to the end of the command, but that suppresses all the output from bash; I just get a blank response, and I can type commands into it and see the result from them, but I see no bash prompt. I tried adding just > /dev/null and that does nothing.



So I've deduced that apparently su is piping all its output over stderr. How can I get su to just suppress those first three lines, but otherwise act normally as if the account weren't expired?










share|improve this question













I created an account "diag" and set it as expired (usermod --expiredate 1). Then I have a script which I want to run to log into it, so in the script I use the following command:



su -s /bin/bash - diag


This outputs like so:



Your account has expired; please contact your system administrator
su: Authentication failure
(Ignored)
diag@computer:~$


And then I'm able to use the account, as expected.



I want to suppress the first three lines, the warning about the expired account. I tried adding 2> /dev/null to the end of the command, but that suppresses all the output from bash; I just get a blank response, and I can type commands into it and see the result from them, but I see no bash prompt. I tried adding just > /dev/null and that does nothing.



So I've deduced that apparently su is piping all its output over stderr. How can I get su to just suppress those first three lines, but otherwise act normally as if the account weren't expired?







debian users su






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Oct 4 '12 at 17:24









Ricket

4423613




4423613











  • What exactly are you trying to do? Beware the XY problem.
    – terdon
    Oct 4 '12 at 17:29











  • I am trying to open a bash prompt for an expired user.
    – Ricket
    Oct 4 '12 at 17:32
















  • What exactly are you trying to do? Beware the XY problem.
    – terdon
    Oct 4 '12 at 17:29











  • I am trying to open a bash prompt for an expired user.
    – Ricket
    Oct 4 '12 at 17:32















What exactly are you trying to do? Beware the XY problem.
– terdon
Oct 4 '12 at 17:29





What exactly are you trying to do? Beware the XY problem.
– terdon
Oct 4 '12 at 17:29













I am trying to open a bash prompt for an expired user.
– Ricket
Oct 4 '12 at 17:32




I am trying to open a bash prompt for an expired user.
– Ricket
Oct 4 '12 at 17:32










2 Answers
2






active

oldest

votes

















up vote
1
down vote













As far as I can tell, user account expiration and lock is functionally the same thing; login attempts will fail, SSH attempts will fail, etc. At least for my purposes they are the same.



So, in my script, I now detect whether the user is expired, and if so, lock the user and set the expiration to 'never'.



It looks something like this:



# Takes 1 parameter, the username to check
# Returns 0 if the user is expired, or 1 if it is not expired.
function userExpired()
cut -d: -f8`

# If diag has no expiration date, it will be empty.
if [[ "$expireDay" -eq "" ]] ; then
return 1
fi

local today=`perl -e 'print int(time/(60*60*24))'`
local daysUntilExpire=`echo $expireDay - $today

# Check if the diag user is expired and if so, lock and unexpire it.
userExpired diag &&
usermod --lock --expiredate -1 diag



I wrote the userExpired function from code found in this forum post (modified to fit my code style and better variable naming).






share|improve this answer




















  • Caution: --lock and --expiredate are subtly different. Lock prevents password login (typically by prepending ! to the password hash in the passwd or shadow file) but a user who previously established SSH keys (for example) will still be able to gain access. In this case, this is unlikely, since your diag user has been custom made, but I note this here for completeness. The expiredate approach is still the recommended approach if you truly want to disable login, but still allow su and friends to work.
    – Cosmic Ossifrage
    Jan 24 '15 at 17:24

















up vote
0
down vote













Redirected stderr to stdout



su -s /bin/bash - diag 2>&1 >/dev/null



This one I haven't tried but expect should work (will update soon once home)



discard=$(su -s /bin/bash - diag)





share|improve this answer




















  • How does this differ from simply redirecting stderr to /dev/null with 2> /dev/null?
    – Ricket
    Oct 4 '12 at 18:15










  • that wont suppress all the output from bash ;) , however I havent tested these, I would appreciate if you can tell what you observed...
    – perilbrain
    Oct 4 '12 at 18:18










  • I think we're having a misunderstanding. I don't want all output suppressed; I just want the su expiration warning to not be displayed.
    – Ricket
    Oct 4 '12 at 18:29










Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













 

draft saved


draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f49931%2fhow-to-suppress-su-authentication-failure-warning%23new-answer', 'question_page');

);

Post as a guest






























2 Answers
2






active

oldest

votes








2 Answers
2






active

oldest

votes









active

oldest

votes






active

oldest

votes








up vote
1
down vote













As far as I can tell, user account expiration and lock is functionally the same thing; login attempts will fail, SSH attempts will fail, etc. At least for my purposes they are the same.



So, in my script, I now detect whether the user is expired, and if so, lock the user and set the expiration to 'never'.



It looks something like this:



# Takes 1 parameter, the username to check
# Returns 0 if the user is expired, or 1 if it is not expired.
function userExpired()
cut -d: -f8`

# If diag has no expiration date, it will be empty.
if [[ "$expireDay" -eq "" ]] ; then
return 1
fi

local today=`perl -e 'print int(time/(60*60*24))'`
local daysUntilExpire=`echo $expireDay - $today

# Check if the diag user is expired and if so, lock and unexpire it.
userExpired diag &&
usermod --lock --expiredate -1 diag



I wrote the userExpired function from code found in this forum post (modified to fit my code style and better variable naming).






share|improve this answer




















  • Caution: --lock and --expiredate are subtly different. Lock prevents password login (typically by prepending ! to the password hash in the passwd or shadow file) but a user who previously established SSH keys (for example) will still be able to gain access. In this case, this is unlikely, since your diag user has been custom made, but I note this here for completeness. The expiredate approach is still the recommended approach if you truly want to disable login, but still allow su and friends to work.
    – Cosmic Ossifrage
    Jan 24 '15 at 17:24














up vote
1
down vote













As far as I can tell, user account expiration and lock is functionally the same thing; login attempts will fail, SSH attempts will fail, etc. At least for my purposes they are the same.



So, in my script, I now detect whether the user is expired, and if so, lock the user and set the expiration to 'never'.



It looks something like this:



# Takes 1 parameter, the username to check
# Returns 0 if the user is expired, or 1 if it is not expired.
function userExpired()
cut -d: -f8`

# If diag has no expiration date, it will be empty.
if [[ "$expireDay" -eq "" ]] ; then
return 1
fi

local today=`perl -e 'print int(time/(60*60*24))'`
local daysUntilExpire=`echo $expireDay - $today

# Check if the diag user is expired and if so, lock and unexpire it.
userExpired diag &&
usermod --lock --expiredate -1 diag



I wrote the userExpired function from code found in this forum post (modified to fit my code style and better variable naming).






share|improve this answer




















  • Caution: --lock and --expiredate are subtly different. Lock prevents password login (typically by prepending ! to the password hash in the passwd or shadow file) but a user who previously established SSH keys (for example) will still be able to gain access. In this case, this is unlikely, since your diag user has been custom made, but I note this here for completeness. The expiredate approach is still the recommended approach if you truly want to disable login, but still allow su and friends to work.
    – Cosmic Ossifrage
    Jan 24 '15 at 17:24












up vote
1
down vote










up vote
1
down vote









As far as I can tell, user account expiration and lock is functionally the same thing; login attempts will fail, SSH attempts will fail, etc. At least for my purposes they are the same.



So, in my script, I now detect whether the user is expired, and if so, lock the user and set the expiration to 'never'.



It looks something like this:



# Takes 1 parameter, the username to check
# Returns 0 if the user is expired, or 1 if it is not expired.
function userExpired()
cut -d: -f8`

# If diag has no expiration date, it will be empty.
if [[ "$expireDay" -eq "" ]] ; then
return 1
fi

local today=`perl -e 'print int(time/(60*60*24))'`
local daysUntilExpire=`echo $expireDay - $today

# Check if the diag user is expired and if so, lock and unexpire it.
userExpired diag &&
usermod --lock --expiredate -1 diag



I wrote the userExpired function from code found in this forum post (modified to fit my code style and better variable naming).






share|improve this answer












As far as I can tell, user account expiration and lock is functionally the same thing; login attempts will fail, SSH attempts will fail, etc. At least for my purposes they are the same.



So, in my script, I now detect whether the user is expired, and if so, lock the user and set the expiration to 'never'.



It looks something like this:



# Takes 1 parameter, the username to check
# Returns 0 if the user is expired, or 1 if it is not expired.
function userExpired()
cut -d: -f8`

# If diag has no expiration date, it will be empty.
if [[ "$expireDay" -eq "" ]] ; then
return 1
fi

local today=`perl -e 'print int(time/(60*60*24))'`
local daysUntilExpire=`echo $expireDay - $today

# Check if the diag user is expired and if so, lock and unexpire it.
userExpired diag &&
usermod --lock --expiredate -1 diag



I wrote the userExpired function from code found in this forum post (modified to fit my code style and better variable naming).







share|improve this answer












share|improve this answer



share|improve this answer










answered Oct 4 '12 at 19:07









Ricket

4423613




4423613











  • Caution: --lock and --expiredate are subtly different. Lock prevents password login (typically by prepending ! to the password hash in the passwd or shadow file) but a user who previously established SSH keys (for example) will still be able to gain access. In this case, this is unlikely, since your diag user has been custom made, but I note this here for completeness. The expiredate approach is still the recommended approach if you truly want to disable login, but still allow su and friends to work.
    – Cosmic Ossifrage
    Jan 24 '15 at 17:24
















  • Caution: --lock and --expiredate are subtly different. Lock prevents password login (typically by prepending ! to the password hash in the passwd or shadow file) but a user who previously established SSH keys (for example) will still be able to gain access. In this case, this is unlikely, since your diag user has been custom made, but I note this here for completeness. The expiredate approach is still the recommended approach if you truly want to disable login, but still allow su and friends to work.
    – Cosmic Ossifrage
    Jan 24 '15 at 17:24















Caution: --lock and --expiredate are subtly different. Lock prevents password login (typically by prepending ! to the password hash in the passwd or shadow file) but a user who previously established SSH keys (for example) will still be able to gain access. In this case, this is unlikely, since your diag user has been custom made, but I note this here for completeness. The expiredate approach is still the recommended approach if you truly want to disable login, but still allow su and friends to work.
– Cosmic Ossifrage
Jan 24 '15 at 17:24




Caution: --lock and --expiredate are subtly different. Lock prevents password login (typically by prepending ! to the password hash in the passwd or shadow file) but a user who previously established SSH keys (for example) will still be able to gain access. In this case, this is unlikely, since your diag user has been custom made, but I note this here for completeness. The expiredate approach is still the recommended approach if you truly want to disable login, but still allow su and friends to work.
– Cosmic Ossifrage
Jan 24 '15 at 17:24












up vote
0
down vote













Redirected stderr to stdout



su -s /bin/bash - diag 2>&1 >/dev/null



This one I haven't tried but expect should work (will update soon once home)



discard=$(su -s /bin/bash - diag)





share|improve this answer




















  • How does this differ from simply redirecting stderr to /dev/null with 2> /dev/null?
    – Ricket
    Oct 4 '12 at 18:15










  • that wont suppress all the output from bash ;) , however I havent tested these, I would appreciate if you can tell what you observed...
    – perilbrain
    Oct 4 '12 at 18:18










  • I think we're having a misunderstanding. I don't want all output suppressed; I just want the su expiration warning to not be displayed.
    – Ricket
    Oct 4 '12 at 18:29














up vote
0
down vote













Redirected stderr to stdout



su -s /bin/bash - diag 2>&1 >/dev/null



This one I haven't tried but expect should work (will update soon once home)



discard=$(su -s /bin/bash - diag)





share|improve this answer




















  • How does this differ from simply redirecting stderr to /dev/null with 2> /dev/null?
    – Ricket
    Oct 4 '12 at 18:15










  • that wont suppress all the output from bash ;) , however I havent tested these, I would appreciate if you can tell what you observed...
    – perilbrain
    Oct 4 '12 at 18:18










  • I think we're having a misunderstanding. I don't want all output suppressed; I just want the su expiration warning to not be displayed.
    – Ricket
    Oct 4 '12 at 18:29












up vote
0
down vote










up vote
0
down vote









Redirected stderr to stdout



su -s /bin/bash - diag 2>&1 >/dev/null



This one I haven't tried but expect should work (will update soon once home)



discard=$(su -s /bin/bash - diag)





share|improve this answer












Redirected stderr to stdout



su -s /bin/bash - diag 2>&1 >/dev/null



This one I haven't tried but expect should work (will update soon once home)



discard=$(su -s /bin/bash - diag)






share|improve this answer












share|improve this answer



share|improve this answer










answered Oct 4 '12 at 17:56









perilbrain

21313




21313











  • How does this differ from simply redirecting stderr to /dev/null with 2> /dev/null?
    – Ricket
    Oct 4 '12 at 18:15










  • that wont suppress all the output from bash ;) , however I havent tested these, I would appreciate if you can tell what you observed...
    – perilbrain
    Oct 4 '12 at 18:18










  • I think we're having a misunderstanding. I don't want all output suppressed; I just want the su expiration warning to not be displayed.
    – Ricket
    Oct 4 '12 at 18:29
















  • How does this differ from simply redirecting stderr to /dev/null with 2> /dev/null?
    – Ricket
    Oct 4 '12 at 18:15










  • that wont suppress all the output from bash ;) , however I havent tested these, I would appreciate if you can tell what you observed...
    – perilbrain
    Oct 4 '12 at 18:18










  • I think we're having a misunderstanding. I don't want all output suppressed; I just want the su expiration warning to not be displayed.
    – Ricket
    Oct 4 '12 at 18:29















How does this differ from simply redirecting stderr to /dev/null with 2> /dev/null?
– Ricket
Oct 4 '12 at 18:15




How does this differ from simply redirecting stderr to /dev/null with 2> /dev/null?
– Ricket
Oct 4 '12 at 18:15












that wont suppress all the output from bash ;) , however I havent tested these, I would appreciate if you can tell what you observed...
– perilbrain
Oct 4 '12 at 18:18




that wont suppress all the output from bash ;) , however I havent tested these, I would appreciate if you can tell what you observed...
– perilbrain
Oct 4 '12 at 18:18












I think we're having a misunderstanding. I don't want all output suppressed; I just want the su expiration warning to not be displayed.
– Ricket
Oct 4 '12 at 18:29




I think we're having a misunderstanding. I don't want all output suppressed; I just want the su expiration warning to not be displayed.
– Ricket
Oct 4 '12 at 18:29

















 

draft saved


draft discarded















































 


draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f49931%2fhow-to-suppress-su-authentication-failure-warning%23new-answer', 'question_page');

);

Post as a guest













































































Popular posts from this blog

Peggy Mitchell

Palaiologos

The Forum (Inglewood, California)