Find the answer to your Linux question:
Results 1 to 6 of 6
Hi all, I had asked this question in another thread but there was no response. Since the question was unrelated to the topic of that thread, I gathered that many ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    May 2008
    Posts
    7

    How to find out when a user account is created?


    Hi all,

    I had asked this question in another thread but there was no response. Since the question was unrelated to the topic of that thread, I gathered that many people might have missed the question. The question is this - How do I find out when a user account is created? /etc/shadow file contains information on when the password was last modified for an account but I could not see any information on how to find out when a unix/linux user account was created.

    TIA
    rizi

  2. #2
    Linux Guru Lakshmipathi's Avatar
    Join Date
    Sep 2006
    Location
    3rd rock from sun - Often seen near moon
    Posts
    1,757

    Exclamation

    Interesting ...I'm not sure about this...some hints that might help you explore

    /var/log/wtmp will have login records ..Is possible to grap user's first entry from this ...can we get a date of login....again here we can't assure first login will remain same as account created date ....

    Hope someone will have easy answer for this ...
    First they ignore you,Then they laugh at you,Then they fight with you,Then you win. - M.K.Gandhi
    -----
    FOSS India Award winning ext3fs Undelete tool www.giis.co.in. Online Linux Terminal http://www.webminal.org

  3. #3
    Linux User
    Join Date
    May 2008
    Location
    NYC, moved from KS & MO
    Posts
    251
    try
    passwd -S username

  4. #4
    Just Joined!
    Join Date
    May 2008
    Posts
    7
    Lakshmipathi and secondmouse - thanks for your responses!

    /var/log/wtmp suggestion is excellent to find the last time the user entered the system but as you have pointed out yourself - the user may not log in the same day the account is created. In my system, they rarely login at all - so I cannot take that date as the date of last login.

    passwd -S prints out a status of the password of the user - the date in the output is the date the password was last changed. So, yes it does give me the date when the user was created but when the password changes the user's creation date is no longer stored

  5. #5
    Linux Guru Lakshmipathi's Avatar
    Join Date
    Sep 2006
    Location
    3rd rock from sun - Often seen near moon
    Posts
    1,757

    Exclamation

    One more suggestion but again not reliable one.
    Checkout the created date of .bash_profile file of the user.
    [If the file is not modified or edited by user ..we got the desired date - Someone correct me if i'm wrong]
    May be you can combine the .bash_profile created date and /var/log/wtmp
    file content and passwd option and trace something out it
    First they ignore you,Then they laugh at you,Then they fight with you,Then you win. - M.K.Gandhi
    -----
    FOSS India Award winning ext3fs Undelete tool www.giis.co.in. Online Linux Terminal http://www.webminal.org

  6. #6
    Linux Guru
    Join Date
    Nov 2007
    Location
    Córdoba (Spain)
    Posts
    1,513
    I wonder why are you so concerned about this. If you are root you should be the one creating the accounts so you shouldn't need any notice.

    Still, you can use inotifywait, from inotify-tools (assuming that your kernel is recent enough to support inotify).

    inotify-tools

    With that tool you can monitor many events on a given point of your filesystem (i.e. /home) like creation of files/dirs for example. Of course, this will only work if you system is configured to create the home dir at the same time that the account is created.

    If not, you could still use inotifywait to monitor /etc/passwd for modification.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •