LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 06-13-2008, 04:17 PM   #1
betoco
LQ Newbie
 
Registered: Jun 2008
Posts: 8

Rep: Reputation: 0
How can get information about the creation date of a user?


Hello all,

IŽll appreciate if you can indicate me how can I get information about the creation date of the users that has been created in the system.

I have a lot of distros in my site and I have to do this task. The distros that I use are: centos, red hat and Ubuntu.

Thanks a lot
mcc
 
Old 06-13-2008, 05:48 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,118
Blog Entries: 54

Rep: Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787
If you keep logs from the time the machines got used, then you could look for useradd|adduser messages in the system logs.
 
Old 06-13-2008, 05:52 PM   #3
stefan_nicolau
Member
 
Registered: Jun 2005
Location: Canada
Distribution: Debian Etch/Sid, Ubuntu
Posts: 529

Rep: Reputation: 32
I don't think there is any reliable way to get this kind of information. Your alternatives are:
- a log kept by your specific user management application (does any user management application keep a log?)
- ls -lc /home/ (if the users don't use their home directories)
- /etc/log/wtmp (if users log in often)
- passwd -S username (if users never change their login password)

Last edited by stefan_nicolau; 06-13-2008 at 05:55 PM.
 
Old 06-13-2008, 06:06 PM   #4
rjlee
Senior Member
 
Registered: Jul 2004
Distribution: Ubuntu 7.04
Posts: 1,990

Rep: Reputation: 67
I don't think that's always possible. Log files on Linux systems are rotated, and typically only kept for a few weeks, or months at most.

The only thing you strictly need to do to add a user to a system is to add a line in the /etc/passwd file. This would not log anything beyond the changing the last update date of the file each time you add a user, so you can tell the last time a user was added (or any of their login details changed), using:
Code:
ls -l /etc/passwd
More commonly, the useradd script is used, which will create a home directory for the user. Some filesystems store the directory creation date, but most don't so you probably can't figure it out this way.

I just tried adding a user to Ubuntu, and it didn't log anything. There are a few patches around that you can use to modify adduser to get it to log the creation of new users; you might try looking for a file called /var/log/adduser.log or similar.

You can run the command lastlog to find out the last time each user logged in, and where they logged in from.

If you are using sudo to create users then all sudo commands get logged, usually into /var/log/secure or /var/log/auth.log

Hope that's of some help!

—Robert J Lee
 
Old 06-14-2008, 05:11 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,118
Blog Entries: 54

Rep: Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787Reputation: 2787
From all those options mentioned the only reliable one is still logging. I started my reply with "if you keep logs" because log retention does depend on legal or business requirements, site policy or in absence of those personal preference. Any good admin who has been (bitten by or made) aware of accountability issues will have altered their log retention anyway. At least on on RHEL and equivalent messages get logged when handling users/groups. If Debian machines don't out of the box, or not at your site, then this is a good reason to change logging options and retention.

Everything else that has to do with reading time from inodes, volatile login records or other logs or files will be extremely unreliable since any arbitrary process can modify it, will account only for the last user added (which could have been a daemon account), and as far as I know it is not possible to tell the creation date from a file. See http://www.securityfocus.com/infocus/1738 and http://www.brandonhutchinson.com/ctime_atime_mtime.html.

Last edited by unSpawn; 06-14-2008 at 05:12 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
File creation date Jay5487 Linux - Newbie 2 03-25-2008 07:47 AM
How to check User ID creation Date? dwarf007 Linux - Security 1 08-22-2007 02:18 AM
System user creation with mysql user creation moos3 Programming 1 08-11-2007 08:01 PM
file creation date prashantbhushan Linux - General 2 05-29-2007 08:32 AM
ls -al file creation date blackzone Linux - Newbie 2 08-23-2004 01:31 AM


All times are GMT -5. The time now is 06:39 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration