adduser

jp_ · 10-18-2005, 12:47 PM

When an admin adds a user where does this get logged to?

example: adduser jp

Where would I look to find this user added in a log?

Mega Man X · 10-18-2005, 12:54 PM

Check /var/log/. It has all interesting logs at your system. You can also change some of the user settings by editing the file /etc/passwd, this includes things like default bash, default home, etc.

jp_ · 10-18-2005, 12:56 PM

Do you happen to know the name of the file that stores all of root's activity?

MensaWater · 10-18-2005, 12:59 PM

No log specifically for adduser so far as I know.

You can try looking at shell history files to see if a specific command was done. Unfortunately the history files don't give timestamps so you can only guess whether the action was done 5 minutes ago or a year ago. Of course if its the last line of the history file and the timestamp on the history file itself is recent then you know when that occurred. You can also make guesses about how likely something was to have happened recently by its proximity to the end of the file.

Matir · 10-18-2005, 01:11 PM

Generally speaking, that command won't have been "logged" per se.

.bash_history is the only likely record unless sudo or su was used to execute the adduser.

jp_ · 10-18-2005, 01:15 PM

How about a log that would list who logged in as SU at a certain time?

Mega Man X · 10-18-2005, 02:11 PM

var/log/messages, if I remember correctly, tells the time and who has tried to "su". I used a program called root-tail before which should display on my desktop background any important changes on the logs. You might want to give it a try if you want full control of what is happening with the logs without the need to read those files directly:

http://www.goof.com/pcg/marc/root-tail.html