How Linux finds the user's creation time

In a Linux system, how do you find the time users create? In fact, there is no standard way to find user creation time. After searching for some information, I have verified and tested these methods for reference only:

1: If the created user has a home directory, then you can ls-l/home/<username>/.bash_logout to find the user's creation time.

[[Email protected] ~] # Cat/etc/shadow | grep test

Test:$1$wl5jxsvt$bjqeby44kjmhaljafkb1f/:16972:0:99999:7:::

[[Email protected] ~] # CAT/ETC/PASSWD | grep test

Test:x:501:501::/home/test:/bin/bash

[[Email protected] ~] # ls-l/home/test/.bash_logout

-rw-r--r--1 Test test June 23:39/home/test/.bash_logout

As shown above, the test user was created on June 19 23:39. This method is obviously not able to get its creation time for users without a home directory.

2: If the created user has a home directory, then you can use ls-ld/home/username/

[[Email protected] ~] # ls-ld/home/test

DRWX------3 test test 4096 June 23:39/home/test

3: View/var/log/secure related logs to see when the user was created

As shown below, you can see that the user test was created 2016-06-19 23:39. However, this method only works for the most recently created user, because/var/log/secure is covered by loops. Users who were created earlier could not be found in these logs at all.

4: In the/etc/shadow file, the third field identifies the password modification date: This is the number of days between the date that the password was last modified and the 1970-1-1. If the account has not been modified since it was created, you can use this field to find the account creation date.

[[Email protected] ~] # awk-f ":" ' {print $, $/etc/shadow} ' | grep Kerry

Kerry 16439

[[Email protected] ~] # ls-l/home/kerry/.bash_logout

-rw-r--r--1 Kerry Kerry 4 2015/home/kerry/.bash_logout

[[Email protected] ~]

2015/01/04 00:00:00

[[Email protected] ~] # passwd Kerry

 for user Kerry.

Bad Password:it is too simplistic/systematic

Passwd:all authentication tokens updated successfully.

[[Email protected] ~] # awk-f ":" ' {print $, $/etc/shadow} ' | grep Kerry

Kerry 16972

 in/var/spool/mail/root

[[Email protected] ~]

2016/06/20 00:00:00

Method 5: Use the Aureport command to view. But this command, for some accounts can not be found to be quite relevant information.

[[Email protected] ~] # Aureport-au | grep test

01/18/2016 23:25:42 test? PTS/1/BIN/SU Yes 99

01/18/2016 23:26:22 Test 192.168.42.1 ssh/usr/sbin/sshd Yes 107

01/18/2016 23:26:22 Test 192.168.42.1 ssh/usr/sbin/sshd No 108

Resources:

http://linux.ittoolbox.com/groups/technical-functional/linuxadmin-l/ how-to-find-out-when-a-user-is-created-in-linux-4677886#m4678008

How Linux finds the user's creation time