How does one find the user's creation time in Linux and how does one find the creation time in linux?

How does one find the user's creation time in Linux and how does one find the creation time in linux?

In Linux, how does one find the time the user created? In fact, there is no standard way to find the User Creation Time. After searching some materials, I verified and tested these methods for reference only:

1: If the created user has a directory, you can use ls-l/home/<username>/. bash_logout to find the user's creation time.

[root@DB-Server ~]# cat /etc/shadow | grep test

test:$1$WL5jXsvt$bJqebY44KjmhaLjaFkB1f/:16972:0:99999:7:::

[root@DB-Server ~]# cat /etc/passwd | grep test

test:x:501:501::/home/test:/bin/bash

[root@DB-Server ~]# ls -l /home/test/.bash_logout

-rw-r--r-- 1 test test 33 Jun 19 23:39 /home/test/.bash_logout

[root@DB-Server ~]# 

As shown above, the test user was created at on April 9, June 19. This method is obviously unable to obtain the creation time of a user without a home directory.

2: If the created user has a directory, you can use ls-ld/home/username/

[root@DB-Server ~]# ls -ld /home/test

drwx------ 3 test test 4096 Jun 19 23:39 /home/test

 

 

3: View/var/log/secure related logs and view the creation time of users.

As shown in the following figure, you can see that the user test was created. However, this method is only valid for recently created users, because/var/log/secure will overwrite it cyclically. Users created earlier times cannot find them from these logs.

4: In the/etc/shadow file, the third field indicates the password modification date, which indicates the number of days between the last password modification date and-1. If the password has not been changed since the account was created, you can use this field to find the Account creation date.

[root@DB-Server ~]#  awk -F ":" '{print $1, $3}'  /etc/shadow | grep kerry

kerry 16439

[root@DB-Server ~]# ls -l /home/kerry/.bash_logout

-rw-r--r-- 1 kerry kerry 33 Jan  4  2015 /home/kerry/.bash_logout

[root@DB-Server ~]# date -d "1970-01-01 16439 days" "+%Y/%m/%d %H:%M:%S" 

2015/01/04 00:00:00

[root@DB-Server ~]# passwd kerry

Changing password for user kerry.

New UNIX password: 

BAD PASSWORD: it is too simplistic/systematic

Retype new UNIX password: 

passwd: all authentication tokens updated successfully.

[root@DB-Server ~]#  awk -F ":" '{print $1, $3}'  /etc/shadow | grep kerry

kerry 16972

You have new mail in /var/spool/mail/root

[root@DB-Server ~]# date -d "1970-01-01 16972 days" "+%Y/%m/%d %H:%M:%S" 

2016/06/20 00:00:00

[root@DB-Server ~]# 

 

Method 5: run the aureport command. However, this command cannot be found for some accounts.

[root@DB-Server ~]# aureport -au | grep test

69. 01/18/2016 23:25:42 test ? pts/1 /bin/su yes 99

70. 01/18/2016 23:26:22 test 192.168.42.1 ssh /usr/sbin/sshd yes 107

71. 01/18/2016 23:26:22 test 192.168.42.1 ssh /usr/sbin/sshd no 108

References:

Http://linux.ittoolbox.com/groups/technical-functional/linuxadmin-l/how-to-find-out-when-a-user-is-created-in-linux-4677886#M4678008