LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (http://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   User creation date (http://www.linuxquestions.org/questions/linux-newbie-8/user-creation-date-819797/)

falconite 07-14-2010 11:06 AM

User creation date
 
Hi All,

I tried a lot to get an answer for how to check when a user was created,but got no answer. Can anybody let me know the command or how to check when a user was created?

smoker 07-14-2010 12:03 PM

Check the date their .bash_logout file was created. That usually doesn't get touched so it should be the original date.
This is assuming that you are talking about a system user with a home directory, not some other kind of unspecified user (you didn't specify).

falconite 07-14-2010 02:05 PM

Quote:

Originally Posted by smoker (Post 4033009)
Check the date their .bash_logout file was created. That usually doesn't get touched so it should be the original date.
This is assuming that you are talking about a system user with a home directory, not some other kind of unspecified user (you didn't specify).

I am not sure about which user to specify. What kind of users are there? Like say, I am newly joined as an Admin in a company. There is a user account in my company and I am asked to find when was this user account or username created. So,how should I go about it. Hope this is quite explicit.

smoker 07-14-2010 02:33 PM

No, sorry. What kind of user are you talking about ?
There are mail users, ftp users, users with shell accounts, users of websites, users of databases, users who can log into the computer from a keyboard, etc, etc.

There are users on this website.

Which are you referring to ?

falconite 07-14-2010 02:54 PM

I think its users with shell accounts. Like, I create a user with username & passwd command. Then how can I check when was this username created?

falconite 07-14-2010 03:08 PM

Quote:

Originally Posted by smoker (Post 4033009)
Check the date their .bash_logout file was created. That usually doesn't get touched so it should be the original date.
This is assuming that you are talking about a system user with a home directory, not some other kind of unspecified user (you didn't specify).

Hey, I think this works. either .bash_logout or .bash_profile file can be checked for this. But, you need to login to this particular user account and then run 'ls -l .bash_logout' command. The reason why I am asking this question is that this was asked to me in an interview. The interviewer said that we need to check a certain log file. I forgot to ask him which log file he was talking about.

Tinkster 07-14-2010 03:24 PM

Any default Linux installation I know of doesn't have any logging
regarding the creation of user accounts. If you have authentication
via LDAP or AD you can use an ldapsearch to find out when & by whom
an account was created.

The time stamps on the files mentioned above could easily be wrong
if the user decided to e.g. edit them, or the admin moved them from
one mountpoint to another at some stage.

And you don't need to login as those users in an ordinary linux setup;
as root an "ls -l /home/*/.bash_logout" should give you all users
times for the .bash_logout file, or "ls -l /home/<username>/.bash_logout"
for an individual account.


Cheers,
Tink

falconite 07-14-2010 04:10 PM

Quote:

Originally Posted by Tinkster (Post 4033169)
Any default Linux installation I know of doesn't have any logging
regarding the creation of user accounts. If you have authentication
via LDAP or AD you can use an ldapsearch to find out when & by whom
an account was created.

The time stamps on the files mentioned above could easily be wrong
if the user decided to e.g. edit them, or the admin moved them from
one mountpoint to another at some stage.

And you don't need to login as those users in an ordinary linux setup;
as root an "ls -l /home/*/.bash_logout" should give you all users
times for the .bash_logout file, or "ls -l /home/<username>/.bash_logout"
for an individual account.


Cheers,
Tink

Yeah..You are right. If you just touch this file, the time stamp changes. I don't know what the interviewer meant. Anyways, thanks a lot guys for all your help.

Rambo_Tribble 07-14-2010 07:44 PM

I have read that some versions of Unix have a /var/log/adduser file which, presumably might have the information of creation time. I haven't found such a file on my Linux installations, though.

burschik 07-15-2010 05:39 AM

Quote:

Originally Posted by Rambo_Tribble (Post 4033349)
I have read that some versions of Unix have a /var/log/adduser file which, presumably might have the information of creation time. I haven't found such a file on my Linux installations, though.

Try /var/log/secure.

stuart_cherrington 07-15-2010 06:17 AM

On most distro's /var/log/secure only goes back 4-5 weeks.

Rambo_Tribble 07-15-2010 09:03 AM

I had tried adding a user and checking ~/secure, but found no entry for adduser, prior to my post.

ezekieldas 07-15-2010 10:15 AM

Check out the manual page for shadow(5) 'man 5 shadow' Your answer might be there.

You might be able to make this determination from one of the fields of an /etc/shadow entry

ezekieldas:$6$VuZUmz8sxxxxSjfFete7yk7aN9tNBtmSL21:13826:0:99999:7:::

Rambo_Tribble 07-15-2010 10:28 AM

Again, I had checked the shadow file, but found nothing that seems to indicate the actual date of the user account creation. Perhaps I've misinterpreted, "days since Jan 1, 1970 that account is disabled", but it wouldn't seem to be relevant.

falconite 07-15-2010 01:20 PM

Man...Is there nobody in this forum who could answer this question? There are so many members in this forum, but nobody has a precised answer for this. Anyways, I am still trying to find this info. If I get, then I will update you all with the same.


All times are GMT -5. The time now is 03:17 AM.