LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices



Reply
 
Search this Thread
Old 07-14-2010, 12:06 PM   #1
falconite
Member
 
Registered: Jul 2010
Posts: 39
Blog Entries: 1

Rep: Reputation: 16
User creation date


Hi All,

I tried a lot to get an answer for how to check when a user was created,but got no answer. Can anybody let me know the command or how to check when a user was created?
 
Old 07-14-2010, 01:03 PM   #2
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
Check the date their .bash_logout file was created. That usually doesn't get touched so it should be the original date.
This is assuming that you are talking about a system user with a home directory, not some other kind of unspecified user (you didn't specify).
 
Old 07-14-2010, 03:05 PM   #3
falconite
Member
 
Registered: Jul 2010
Posts: 39
Blog Entries: 1

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by smoker View Post
Check the date their .bash_logout file was created. That usually doesn't get touched so it should be the original date.
This is assuming that you are talking about a system user with a home directory, not some other kind of unspecified user (you didn't specify).
I am not sure about which user to specify. What kind of users are there? Like say, I am newly joined as an Admin in a company. There is a user account in my company and I am asked to find when was this user account or username created. So,how should I go about it. Hope this is quite explicit.
 
Old 07-14-2010, 03:33 PM   #4
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
No, sorry. What kind of user are you talking about ?
There are mail users, ftp users, users with shell accounts, users of websites, users of databases, users who can log into the computer from a keyboard, etc, etc.

There are users on this website.

Which are you referring to ?
 
1 members found this post helpful.
Old 07-14-2010, 03:54 PM   #5
falconite
Member
 
Registered: Jul 2010
Posts: 39
Blog Entries: 1

Original Poster
Rep: Reputation: 16
I think its users with shell accounts. Like, I create a user with username & passwd command. Then how can I check when was this username created?
 
Old 07-14-2010, 04:08 PM   #6
falconite
Member
 
Registered: Jul 2010
Posts: 39
Blog Entries: 1

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by smoker View Post
Check the date their .bash_logout file was created. That usually doesn't get touched so it should be the original date.
This is assuming that you are talking about a system user with a home directory, not some other kind of unspecified user (you didn't specify).
Hey, I think this works. either .bash_logout or .bash_profile file can be checked for this. But, you need to login to this particular user account and then run 'ls -l .bash_logout' command. The reason why I am asking this question is that this was asked to me in an interview. The interviewer said that we need to check a certain log file. I forgot to ask him which log file he was talking about.
 
Old 07-14-2010, 04:24 PM   #7
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,005
Blog Entries: 11

Rep: Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903
Any default Linux installation I know of doesn't have any logging
regarding the creation of user accounts. If you have authentication
via LDAP or AD you can use an ldapsearch to find out when & by whom
an account was created.

The time stamps on the files mentioned above could easily be wrong
if the user decided to e.g. edit them, or the admin moved them from
one mountpoint to another at some stage.

And you don't need to login as those users in an ordinary linux setup;
as root an "ls -l /home/*/.bash_logout" should give you all users
times for the .bash_logout file, or "ls -l /home/<username>/.bash_logout"
for an individual account.


Cheers,
Tink
 
Old 07-14-2010, 05:10 PM   #8
falconite
Member
 
Registered: Jul 2010
Posts: 39
Blog Entries: 1

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by Tinkster View Post
Any default Linux installation I know of doesn't have any logging
regarding the creation of user accounts. If you have authentication
via LDAP or AD you can use an ldapsearch to find out when & by whom
an account was created.

The time stamps on the files mentioned above could easily be wrong
if the user decided to e.g. edit them, or the admin moved them from
one mountpoint to another at some stage.

And you don't need to login as those users in an ordinary linux setup;
as root an "ls -l /home/*/.bash_logout" should give you all users
times for the .bash_logout file, or "ls -l /home/<username>/.bash_logout"
for an individual account.


Cheers,
Tink
Yeah..You are right. If you just touch this file, the time stamp changes. I don't know what the interviewer meant. Anyways, thanks a lot guys for all your help.
 
Old 07-14-2010, 08:44 PM   #9
Rambo_Tribble
Member
 
Registered: Aug 2005
Location: N 44 Deg. 56.537' W 123 Deg. 3.683'
Distribution: Kubuntu, MEPIS, SUSE & Debian
Posts: 30

Rep: Reputation: 19
I have read that some versions of Unix have a /var/log/adduser file which, presumably might have the information of creation time. I haven't found such a file on my Linux installations, though.

Last edited by Rambo_Tribble; 07-14-2010 at 10:57 PM. Reason: update
 
Old 07-15-2010, 06:39 AM   #10
burschik
Member
 
Registered: Jul 2008
Posts: 159

Rep: Reputation: 31
Quote:
Originally Posted by Rambo_Tribble View Post
I have read that some versions of Unix have a /var/log/adduser file which, presumably might have the information of creation time. I haven't found such a file on my Linux installations, though.
Try /var/log/secure.
 
Old 07-15-2010, 07:17 AM   #11
stuart_cherrington
Member
 
Registered: Aug 2008
Location: Get back in your Cube Unix Boy!
Distribution: rh5, oel5, debian etch, solaris
Posts: 228

Rep: Reputation: 36
On most distro's /var/log/secure only goes back 4-5 weeks.
 
Old 07-15-2010, 10:03 AM   #12
Rambo_Tribble
Member
 
Registered: Aug 2005
Location: N 44 Deg. 56.537' W 123 Deg. 3.683'
Distribution: Kubuntu, MEPIS, SUSE & Debian
Posts: 30

Rep: Reputation: 19
I had tried adding a user and checking ~/secure, but found no entry for adduser, prior to my post.
 
Old 07-15-2010, 11:15 AM   #13
ezekieldas
Member
 
Registered: Mar 2010
Posts: 122

Rep: Reputation: 16
Check out the manual page for shadow(5) 'man 5 shadow' Your answer might be there.

You might be able to make this determination from one of the fields of an /etc/shadow entry

ezekieldas:$6$VuZUmz8sxxxxSjfFete7yk7aN9tNBtmSL21:13826:0:99999:7:::
 
Old 07-15-2010, 11:28 AM   #14
Rambo_Tribble
Member
 
Registered: Aug 2005
Location: N 44 Deg. 56.537' W 123 Deg. 3.683'
Distribution: Kubuntu, MEPIS, SUSE & Debian
Posts: 30

Rep: Reputation: 19
Again, I had checked the shadow file, but found nothing that seems to indicate the actual date of the user account creation. Perhaps I've misinterpreted, "days since Jan 1, 1970 that account is disabled", but it wouldn't seem to be relevant.
 
Old 07-15-2010, 02:20 PM   #15
falconite
Member
 
Registered: Jul 2010
Posts: 39
Blog Entries: 1

Original Poster
Rep: Reputation: 16
Man...Is there nobody in this forum who could answer this question? There are so many members in this forum, but nobody has a precised answer for this. Anyways, I am still trying to find this info. If I get, then I will update you all with the same.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
images creation date newer than last modified date fenrisW0lf Linux - Newbie 3 07-28-2009 06:04 PM
How can get information about the creation date of a user? betoco Linux - Software 4 06-14-2008 06:11 AM
File creation date Jay5487 Linux - Newbie 2 03-25-2008 08:47 AM
How to check User ID creation Date? dwarf007 Linux - Security 1 08-22-2007 03:18 AM
System user creation with mysql user creation moos3 Programming 1 08-11-2007 09:01 PM


All times are GMT -5. The time now is 11:02 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration