LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 07-15-2010, 01:30 PM   #16
trickykid
Guru
 
Registered: Jan 2001
Posts: 24,133

Rep: Reputation: 197Reputation: 197

Quote:
Originally Posted by falconite View Post
Man...Is there nobody in this forum who could answer this question? There are so many members in this forum, but nobody has a precised answer for this. Anyways, I am still trying to find this info. If I get, then I will update you all with the same.
There are plenty of logical answers given. You should have learned several things by reading the replies:

1. A native Linux install doesn't record the initial creation date.
2. If created and not touched when the user was created, .bash_logout is a good chance at determining the date.
3. Unless you keep a record of all logs or bash history for users, you cannot determine the date.

Honestly, if you want to keep track of when a user is created, there are fields in the /etc/passwd file you can specify a users full name, phone number and other info, you can add a creation date here when you create the user.

useradd -c or --comment options can be used as a text string, reserved for description of user (ex. Full Name).
 
Old 07-15-2010, 01:39 PM   #17
Rambo_Tribble
Member
 
Registered: Aug 2005
Location: N 44 Deg. 56.537' W 123 Deg. 3.683'
Distribution: Kubuntu, MEPIS, SUSE & Debian
Posts: 30

Rep: Reputation: 19
The apparent answer is that most Linux distributions do not store the timestamp of user account creation. At least some forms of Unix, including some of the BSDs, maintain a log of adduser activity, which may hold that information, but you'd need access to such an installation to determine that.

Some filesystems are reported to store file creation date and, on such a filesystem the creation date of the user's home directory would give a fairly reliable indication of when the account was initiated. The common Linux filesystems, ext2 and ext3 do not store this information. It should be easy enough for you to determine if ext4, Btrfs, or other filesystems have such facility, if they are available to you. Otherwise, I'd suggest starting another thread to poll those with such filesystems at their immediate disposal.
 
Old 07-15-2010, 01:40 PM   #18
ezekieldas
Member
 
Registered: Mar 2010
Posts: 122

Rep: Reputation: 16
Here are two accounts I created on two different dates. You can do the math from here:

ezekieldas:$1$yMRsM5LJ$osafajE7vibaU/:14778:0:99999:7:::
xyz:!!:14805:0:99999:7:::

---
Install tripwire

---

Also, check your logs:

/var/log/messages

Jul 15 11:33:17 fr-virt001 useradd[1123]: new group: name=xyz, GID=501
Jul 15 11:33:17 fr-virt001 useradd[1123]: new user: name=xyz, UID=501, GID=501, home=/home/xyz, shell=/bin/bash
 
Old 07-15-2010, 01:49 PM   #19
trickykid
Guru
 
Registered: Jan 2001
Posts: 24,133

Rep: Reputation: 197Reputation: 197
Quote:
Originally Posted by ezekieldas View Post
Here are two accounts I created on two different dates. You can do the math from here:

ezekieldas:$1$yMRsM5LJ$osafajE7vibaU/:14778:0:99999:7:::
xyz:!!:14805:0:99999:7:::

---
Install tripwire

---

Also, check your logs:

/var/log/messages

Jul 15 11:33:17 fr-virt001 useradd[1123]: new group: name=xyz, GID=501
Jul 15 11:33:17 fr-virt001 useradd[1123]: new user: name=xyz, UID=501, GID=501, home=/home/xyz, shell=/bin/bash
The only problem with /var/log/messages is by default it gets rotated, unless changed to keep all logs forever, if the system has been running for quite sometime, not a very good way to get such info from.

I don't know any sysadmin that keeps tabs on file changes with tripwire on log files, since these are changed all the time. It would only make sense if you tell it to monitor /etc/passwd, /etc/shadow but then again, on a busy system with a lot of users, you might be getting a bunch of useless info. It would report a change everytime a user changes their password, etc.
 
Old 07-15-2010, 01:50 PM   #20
trickykid
Guru
 
Registered: Jan 2001
Posts: 24,133

Rep: Reputation: 197Reputation: 197
Now another way is to take the stamp in the shadow file of the last time the password changed, but that would only give you time of creation if the user has never changed their password, which I don't recommend and a force of password changes is a good thing on any system after 60-90 days on most systems.
 
Old 07-15-2010, 01:56 PM   #21
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
Quote:
Originally Posted by falconite
Man...Is there nobody in this forum who could answer this question? There are so many members in this forum, but nobody has a precised answer for this. Anyways, I am still trying to find this info. If I get, then I will update you all with the same.
There is no answer because there is no answer. The only way to check the creation date is to record the creation date at the time of creation. there are various auditing systems that will create and check things like that, but only after they've been installed.
Try googling and read some of the solutions.
You could create your own logfile, by adding a file which is owned by root to /etc/skel . (files in /etc/skel get added to a users home directory when it is created). The user will never be able to edit it, and if you script the file creation, any date inside the file cannot be changed if the file is moved to a new partition.

Last edited by smoker; 07-15-2010 at 02:08 PM.
 
Old 07-15-2010, 01:58 PM   #22
trickykid
Guru
 
Registered: Jan 2001
Posts: 24,133

Rep: Reputation: 197Reputation: 197
Quote:
Originally Posted by smoker View Post
There is no answer because there is no answer. The only way to check the creation date is to record the creation date at the time of creation. there are various auditing systems that will create and check things like that, but only after they've been installed.
Try googling and read some of the solutions.
You could create your own logfile, by adding a file to /etc/skel which is owned by root. (files in /etc/skel get added to a users home directory when it is created). The user will never be able to edit it, and if you script the file creation, any date inside the file cannot be changed if the file is moved to a new partition.
Yeah, like my suggestion, use the -c option or manually edit the text field in the /etc/passwd with the creation date.

Example:

Code:
johndoe:x:500:500:John Doe Created-2010-07-15:/home/jdoe:/bin/bash
 
Old 07-15-2010, 02:09 PM   #23
Rambo_Tribble
Member
 
Registered: Aug 2005
Location: N 44 Deg. 56.537' W 123 Deg. 3.683'
Distribution: Kubuntu, MEPIS, SUSE & Debian
Posts: 30

Rep: Reputation: 19
ezekieldas,

Your results may be distribution or log settings dependent, as I tried adding and removing a user on my Hardy installation and no entries resulted in the messages file. I did use the System Settings to add the user and not adduser, but I must assume the GUI simply calls the utility.
 
Old 07-15-2010, 02:12 PM   #24
ezekieldas
Member
 
Registered: Mar 2010
Posts: 122

Rep: Reputation: 16
sure -- you might also set something up in /etc/skel to use logger.
 
Old 07-15-2010, 04:45 PM   #25
Rambo_Tribble
Member
 
Registered: Aug 2005
Location: N 44 Deg. 56.537' W 123 Deg. 3.683'
Distribution: Kubuntu, MEPIS, SUSE & Debian
Posts: 30

Rep: Reputation: 19
Another possibility suggests itself: Many distros use adduser, a Perl script, to call and pass parameters to useradd, an executable. In Ubuntu, for instance, adduser.conf is what causes the files in /etc/skel to be created in the new user directory; in the /etc/default/useradd configuration file, the line which would cause useradd to create such files is commented out,(actually, all the lines in the file are commented out on my installation, except SHELL=/bin/sh). It shouldn't take much to add a line or two to the script creating a file with a timestamp in it.

Naturally, one would need at least a little knowledge of Perl, a requirement many might find onerous, (sorry, Larry). Such a solution must be taken preemptively, of course, and does little for trying to determine account creation date after the fact.

Last edited by Rambo_Tribble; 07-15-2010 at 04:48 PM.
 
Old 07-15-2010, 05:04 PM   #26
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 22,965
Blog Entries: 11

Rep: Reputation: 865Reputation: 865Reputation: 865Reputation: 865Reputation: 865Reputation: 865Reputation: 865
Quote:
Originally Posted by falconite View Post
Man...Is there nobody in this forum who could answer this question? There are so many members in this forum, but nobody has a precised answer for this. Anyways, I am still trying to find this info. If I get, then I will update you all with the same.
You GOT the answers. There is no default/standard way.
You need to devise a mechanism/process yourself; or use LDAP.


Cheers,
Tink
 
Old 07-15-2010, 05:45 PM   #27
Rambo_Tribble
Member
 
Registered: Aug 2005
Location: N 44 Deg. 56.537' W 123 Deg. 3.683'
Distribution: Kubuntu, MEPIS, SUSE & Debian
Posts: 30

Rep: Reputation: 19
Wait a minute

Tinkster,

Your tag line about Windows not being that bad originally suggests you weren't around for the early versions. The BSOD has been with us since the beginning, which was more like 25 years ago. Trust me on this: Windows and DOS before it have always been a tangle of spaghetti code and memory leaks.
 
Old 07-15-2010, 05:50 PM   #28
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 22,965
Blog Entries: 11

Rep: Reputation: 865Reputation: 865Reputation: 865Reputation: 865Reputation: 865Reputation: 865Reputation: 865
Maybe I need to update my sig ;} ... I've used M$-Dos 3.1 and Windblows 2 (yes,
the fugly black and white thing that looked like GEMs poor relation).



Cheers,
Tink
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
images creation date newer than last modified date fenrisW0lf Linux - Newbie 3 07-28-2009 05:04 PM
How can get information about the creation date of a user? betoco Linux - Software 4 06-14-2008 05:11 AM
File creation date Jay5487 Linux - Newbie 2 03-25-2008 07:47 AM
How to check User ID creation Date? dwarf007 Linux - Security 1 08-22-2007 02:18 AM
System user creation with mysql user creation moos3 Programming 1 08-11-2007 08:01 PM


All times are GMT -5. The time now is 05:34 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration