How does one find the user's creation time in Linux and how does one find the creation time in linux?

Source: Internet
Author: User

How does one find the user's creation time in Linux and how does one find the creation time in linux?

In Linux, how does one find the time the user created? In fact, there is no standard way to find the User Creation Time. After searching some materials, I verified and tested these methods for reference only:

1: If the created user has a directory, you can use ls-l/home/<username>/. bash_logout to find the user's creation time.

[root@DB-Server ~]# cat /etc/shadow | grep test
test:$1$WL5jXsvt$bJqebY44KjmhaLjaFkB1f/:16972:0:99999:7:::
[root@DB-Server ~]# cat /etc/passwd | grep test
test:x:501:501::/home/test:/bin/bash
[root@DB-Server ~]# ls -l /home/test/.bash_logout
-rw-r--r-- 1 test test 33 Jun 19 23:39 /home/test/.bash_logout
[root@DB-Server ~]# 

As shown above, the test user was created at on April 9, June 19. This method is obviously unable to obtain the creation time of a user without a home directory.

2: If the created user has a directory, you can use ls-ld/home/username/

[root@DB-Server ~]# ls -ld /home/test
drwx------ 3 test test 4096 Jun 19 23:39 /home/test

 

 

3: View/var/log/secure related logs and view the creation time of users.

As shown in the following figure, you can see that the user test was created. However, this method is only valid for recently created users, because/var/log/secure will overwrite it cyclically. Users created earlier times cannot find them from these logs.

4: In the/etc/shadow file, the third field indicates the password modification date, which indicates the number of days between the last password modification date and-1. If the password has not been changed since the account was created, you can use this field to find the Account creation date.

[root@DB-Server ~]#  awk -F ":" '{print $1, $3}'  /etc/shadow | grep kerry
kerry 16439
[root@DB-Server ~]# ls -l /home/kerry/.bash_logout
-rw-r--r-- 1 kerry kerry 33 Jan  4  2015 /home/kerry/.bash_logout
[root@DB-Server ~]# date -d "1970-01-01 16439 days" "+%Y/%m/%d %H:%M:%S" 
2015/01/04 00:00:00
[root@DB-Server ~]# passwd kerry
Changing password for user kerry.
New UNIX password: 
BAD PASSWORD: it is too simplistic/systematic
Retype new UNIX password: 
passwd: all authentication tokens updated successfully.
[root@DB-Server ~]#  awk -F ":" '{print $1, $3}'  /etc/shadow | grep kerry
kerry 16972
You have new mail in /var/spool/mail/root
[root@DB-Server ~]# date -d "1970-01-01 16972 days" "+%Y/%m/%d %H:%M:%S" 
2016/06/20 00:00:00
[root@DB-Server ~]# 

 

Method 5: run the aureport command. However, this command cannot be found for some accounts.

[root@DB-Server ~]# aureport -au | grep test
69. 01/18/2016 23:25:42 test ? pts/1 /bin/su yes 99
70. 01/18/2016 23:26:22 test 192.168.42.1 ssh /usr/sbin/sshd yes 107
71. 01/18/2016 23:26:22 test 192.168.42.1 ssh /usr/sbin/sshd no 108

References:

Http://linux.ittoolbox.com/groups/technical-functional/linuxadmin-l/how-to-find-out-when-a-user-is-created-in-linux-4677886#M4678008

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.