HowTo Find Linux User Created Date Is There Any Way

HowTo Find Linux User Created Date there is no straight forward answer because there is no record can show you when Linux user is created. Then how.? If you follow standard practice (Best practice) to create an Linux user than its make your Linux administration life easier. What are those best practices while creating user will see in this post.

Find Linux User Created Date Using Below Steps

When you creating user it will modify few files and add entries, verify them then you will get more information about user creation date see Useradd Guide

• Use stat command on /home/user_name/.bash_logout
• /etc/passwd file for user info
• Chage command for checking user password aging details
• passwd command to check last password change details
• last command to check user logged in info
• aureport command to see authentication related info
• /var/log/secure log file

stat command on .bash_logout file

In each and every user home path .bash_logout file will placed by default when user is created, this file is used to execute when user logout, to clean/clear screen.  Running stat command will provide the information about file accessed, changed and modified date and time details

/etc/passwd file

passwd file will not provide any created date details/information but when you follow best practice while creating an user example

Use comment option to write an details like

• Internal ticket/case number
• Date and Time

Best Practice

# useradd -u 1003 -g users -G extendedusers -c "`date "+%F"` #TicketNumber Administrator User" -s /bin/bash -d /opt/home/arkit arkit

if you use above like practice which will add creation date & time and also internal ticket number to identify the details

chage command information

using chage find out when last password was changed. If user is not changed his password since creation date then chage command will help you out find Linux user created date.

Note: if you have internal password aging policy then this wont work as expected.

passwd command

This command also provides user last changed password information if user is not changed his password since user created date then which will be helpful to find Linux user created date

[root@rhel7 user]# passwd -S arkit
arkit LK 2018-09-26 0 99999 7 -1 (Password locked.)

last will tell you user login information

command will help you in finding the user login information to the system. Using this login details you can find out Linux user created date based on his first login.

aureport

Audit report information is useful when user is logged in last time and first time, unfortunately if user access is list more getting the correct information is going to be hectic

# aureport -au |grep arkit

Secure Log file

/var/log/secure is an log file where you can find all the security related information. If you have centralized syslog server and log messages got archive for future audit purpose you can find the exact Linux user created date in this log file.

# cat var/log/secure |grep -i "new user"
# cat /var/log/secure |grep -i "useradd"

As shown in above screenshot you can find Linux user created date exactly in this log file

Related Articles

samba share multi user access

add user without using useradd command

create multiple users using single command

RHCSA Certification Guide