How to find out when a user account is created?

[rizi]

Hi all,

I had asked this question in another thread but there was no response. Since the question was unrelated to the topic of that thread, I gathered that many people might have missed the question. The question is this - How do I find out when a user account is created? /etc/shadow file contains information on when the password was last modified for an account but I could not see any information on how to find out when a unix/linux user account was created.

TIA
rizi

[Lakshmipathi]

Interesting ...I'm not sure about this...some hints that might help you explore

/var/log/wtmp will have login records ..Is possible to grap user's first entry from this ...can we get a date of login....again here we can't assure first login will remain same as account created date ....

Hope someone will have easy answer for this ...

[secondmouse]

try
passwd -S username

[rizi]

Lakshmipathi and secondmouse - thanks for your responses!

/var/log/wtmp suggestion is excellent to find the last time the user entered the system but as you have pointed out yourself - the user may not log in the same day the account is created. In my system, they rarely login at all - so I cannot take that date as the date of last login.

passwd -S prints out a status of the password of the user - the date in the output is the date the password was last changed. So, yes it does give me the date when the user was created but when the password changes the user's creation date is no longer stored

[Lakshmipathi]

One more suggestion but again not reliable one.
Checkout the created date of .bash_profile file of the user.
[If the file is not modified or edited by user ..we got the desired date - Someone correct me if i'm wrong]
May be you can combine the .bash_profile created date and /var/log/wtmp
file content and passwd option and trace something out it

[i92guboj]

I wonder why are you so concerned about this. If you are root you should be the one creating the accounts so you shouldn't need any notice.

Still, you can use inotifywait, from inotify-tools (assuming that your kernel is recent enough to support inotify).

inotify-tools

With that tool you can monitor many events on a given point of your filesystem (i.e. /home) like creation of files/dirs for example. Of course, this will only work if you system is configured to create the home dir at the same time that the account is created.

If not, you could still use inotifywait to monitor /etc/passwd for modification.