A summary of several ways to view user creation dates on Linux

preface

Do you know how to check the date of account creation on Linux system? If so, what are the ways?

Did you succeed? If so, how?

Basically, the Linux system does not track this information, so what are the alternatives to getting this information?

You might ask, why am I checking this?

Yes, in some cases, you may need to look at this information, and then it will be helpful to you.

You can use the following seven methods for validation.

Use/var log/secure Use the aureport tool Using the bash_logout Use the chage command Use the useradd command Use the passwd command Use the last command

Method 1: Use /var/log/secure

It stores all security-related messages, including authentication failures and authorization privileges. It also tracks sudo logins, SSH logins, and other error records through the system security daemon.

# grep prakash /var/log/secure
Apr 12 04:07:18 centos.2daygeek.com useradd[21263]: new group: name=prakash, GID=501
Apr 12 04:07:18 centos.2daygeek.com useradd[21263]: new user: name=prakash, UID=501, GID=501, home=/home/prakash, shell=/bin/bash
Apr 12 04:07:34 centos.2daygeek.com passwd: pam_unix(passwd:chauthtok): password changed for prakash
Apr 12 04:08:32 centos.2daygeek.com sshd[21269]: Accepted password for prakash from 103.5.134.167 port 60554 ssh2
Apr 12 04:08:32 centos.2daygeek.com sshd[21269]: pam_unix(sshd:session): session opened for user prakash by (uid=0)

Approach 2: Use the aureport tool

The aureport tool generates summary and columnar reports based on event records recorded in the audit log. By default, it queries all audit.log files in the /var/log/audit/ directory to create a report.

# aureport --auth | grep prakash
46. 04/12/2018 04:08:32 prakash 103.5.134.167 ssh /usr/sbin/sshd yes 288
47. 04/12/2018 04:08:32 prakash 103.5.134.167 ssh /usr/sbin/sshd yes 291

Method 3: Use.bash_ES52en

The.bash_ES57en in the home directory has a special meaning for bash, which provides a way to execute commands when the user exits the system.

We can see the change date of.bash_ES62en in the user's home directory. This file is created the first time the user logs out.

# stat /home/prakash/.bash_logout
 File: `/home/prakash/.bash_logout'
 Size: 18 Blocks: 8 IO Block: 4096 regular file
Device: 801h/2049d Inode: 256153 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 501/ prakash) Gid: ( 501/ prakash)
Access: 2017-03-22 20:15:00.000000000 -0400
Modify: 2017-03-22 20:15:00.000000000 -0400
Change: 2018-04-12 04:07:18.283000323 -0400

Option 4: Use the chage command

chage means "change age". This command lets users manage password expiration information. The chage command changes the number of days you need to change your password since the last password change date.

The system USES this information to determine when a user must change his password. This is useful if the user has not changed the password since the account creation date.

# chage --list prakash
Last password change : Apr 12, 2018
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7

Option 5: Use the useradd command

The useradd command is used to create a new account in Linux. By default, it does not add a user-created date; we must add a date using the Remarks option.

# useradd -m prakash -c `date +%Y/%m/%d`
# grep prakash /etc/passwd
prakash:x:501:501:2018/04/12:/home/prakash:/bin/bash

Option 6: Use the passwd command

The passwd command is used to assign passwords to local accounts or users. If the user did not change his password after the account was created, he can use the passwd command to see the date of the last password change.

# passwd -S prakash
prakash PS 2018-04-11 0 99999 7 -1 (Password set, MD5 crypt.)

Method 7: Use the last command

The last command reads /var/log/wtmp and displays a list of all users who have logged in (and logged out) since the file was created.

# last | grep "prakash"
prakash pts/2 103.5.134.167 Thu Apr 12 04:08 still logged in

via: https://www.2daygeek.com/how-to-check-user-created-date-on-linux/

Author: Prakash Subramanian selected topic: lujun9972 geekpi proofread: wxy

conclusion