HowTo Find Linux User Created Date Is There Any Way
HowTo Find Linux User Created Date there is no straight forward answer because there is no record can show you when Linux user is created. Then how.? If you follow standard practice (Best practice) to create an Linux user than its make your Linux administration life easier. What are those best practices while creating user will see in this post.
Find Linux User Created Date Using Below Steps
When you creating user it will modify few files and add entries, verify them then you will get more information about user creation date see Useradd Guide
- Use stat command on /home/user_name/.bash_logout
- /etc/passwd file for user info
- Chage command for checking user password aging details
- passwd command to check last password change details
- last command to check user logged in info
- aureport command to see authentication related info
- /var/log/secure log file
stat command on .bash_logout file
In each and every user home path .bash_logout file will placed by default when user is created, this file is used to execute when user logout, to clean/clear screen. Running stat command will provide the information about file accessed, changed and modified date and time details
passwd file will not provide any created date details/information but when you follow best practice while creating an user example
Use comment option to write an details like
- Internal ticket/case number
- Date and Time
# useradd -u 1003 -g users -G extendedusers -c "`date "+%F"` #TicketNumber Administrator User" -s /bin/bash -d /opt/home/arkit arkit
if you use above like practice which will add creation date & time and also internal ticket number to identify the details
chage command information
using chage find out when last password was changed. If user is not changed his password since creation date then chage command will help you out find Linux user created date.
Note: if you have internal password aging policy then this wont work as expected.
This command also provides user last changed password information if user is not changed his password since user created date then which will be helpful to find Linux user created date
[root@rhel7 user]# passwd -S arkit arkit LK 2018-09-26 0 99999 7 -1 (Password locked.)
last will tell you user login information
command will help you in finding the user login information to the system. Using this login details you can find out Linux user created date based on his first login.
Audit report information is useful when user is logged in last time and first time, unfortunately if user access is list more getting the correct information is going to be hectic
# aureport -au |grep arkit
Secure Log file
/var/log/secure is an log file where you can find all the security related information. If you have centralized syslog server and log messages got archive for future audit purpose you can find the exact Linux user created date in this log file.
# cat var/log/secure |grep -i "new user" # cat /var/log/secure |grep -i "useradd"
As shown in above screenshot you can find Linux user created date exactly in this log file