Hi All,

I tried a lot to get an answer for how to check when a user was created,but got no answer. Can anybody let me know the command or how to check when a user was created?

Check the date their .bash_logout file was created. That usually doesn't get touched so it should be the original date.
This is assuming that you are talking about a system user with a home directory, not some other kind of unspecified user (you didn't specify).

I am not sure about which user to specify. What kind of users are there? Like say, I am newly joined as an Admin in a company. There is a user account in my company and I am asked to find when was this user account or username created. So,how should I go about it. Hope this is quite explicit.

No, sorry. What kind of user are you talking about ?
There are mail users, ftp users, users with shell accounts, users of websites, users of databases, users who can log into the computer from a keyboard, etc, etc.

There are users on this website.

Which are you referring to ?

1 members found this post helpful.

I think its users with shell accounts. Like, I create a user with username & passwd command. Then how can I check when was this username created?

Hey, I think this works. either .bash_logout or .bash_profile file can be checked for this. But, you need to login to this particular user account and then run 'ls -l .bash_logout' command. The reason why I am asking this question is that this was asked to me in an interview. The interviewer said that we need to check a certain log file. I forgot to ask him which log file he was talking about.

Any default Linux installation I know of doesn't have any logging
regarding the creation of user accounts. If you have authentication
via LDAP or AD you can use an ldapsearch to find out when & by whom
an account was created.

The time stamps on the files mentioned above could easily be wrong
if the user decided to e.g. edit them, or the admin moved them from
one mountpoint to another at some stage.

And you don't need to login as those users in an ordinary linux setup;
as root an "ls -l /home/*/.bash_logout" should give you all users
times for the .bash_logout file, or "ls -l /home/<username>/.bash_logout"
for an individual account.


Cheers,
Tink

Yeah..You are right. If you just touch this file, the time stamp changes. I don't know what the interviewer meant. Anyways, thanks a lot guys for all your help.

I have read that some versions of Unix have a /var/log/adduser file which, presumably might have the information of creation time. I haven't found such a file on my Linux installations, though.

Try /var/log/secure.

On most distro's /var/log/secure only goes back 4-5 weeks.

I had tried adding a user and checking ~/secure, but found no entry for adduser, prior to my post.

Check out the manual page for shadow(5) 'man 5 shadow' Your answer might be there.

You might be able to make this determination from one of the fields of an /etc/shadow entry

ezekieldas:$6$VuZUmz8sxxxxSjfFete7yk7aN9tNBtmSL21:13826:0:99999:7:::

Again, I had checked the shadow file, but found nothing that seems to indicate the actual date of the user account creation. Perhaps I've misinterpreted, "days since Jan 1, 1970 that account is disabled", but it wouldn't seem to be relevant.

Man...Is there nobody in this forum who could answer this question? There are so many members in this forum, but nobody has a precised answer for this. Anyways, I am still trying to find this info. If I get, then I will update you all with the same.