topic Re: user info in Operating System - HP-UX

user info

John McDen — Thu, 02 May 2002 20:27:37 GMT

Is ther way to know when was a user account created on the system??

Re: user info

Sridhar Bhaskarla — Thu, 02 May 2002 20:35:03 GMT

General answer is no. If you didn't recycle samlog and if the user was added through SAM, you can use /usr/sam/bin/samlog_viewer to find previous logs.

-Sri

Re: user info

hpuxrox — Thu, 02 May 2002 20:36:46 GMT

Other than the date and time stamps on their home directorys( Which can be changes at a later time. ), I can't think of one single way.

Maybe go look at the last log or check backups to get a round about time.

-Yates

Re: user info

S.K. Chan — Thu, 02 May 2002 20:37:44 GMT

"First created" .. I would say no, otherwise we would not include this info in our GECOS field.

"First logon" .. possible by tracing utmp/wtmp file entries.

Re: user info

Uday_S_Ankolekar — Thu, 02 May 2002 20:40:03 GMT

Hello,

I don't think you can do this. But if you are sure about users .profile files from home directory were not modified then time stamp would give you general idea when it was created.

But this would be just guessing.

-USA..

Re: user info

Sukant Naik — Fri, 03 May 2002 06:11:09 GMT

Hi John,

Its very dificult to say when the user has been created.

But there is a command called 'last' which can give you when the user had last logged in.

# last sukant
sukant pts/tb Fri Apr 26 21:00 - 21:00 (00:00)
sukant pts/tb Fri Apr 26 20:59 - 21:00 (00:00)
sukant pts/tb Fri Apr 26 20:59 - 20:59 (00:00)
sukant pts/tb Wed Apr 24 15:08 - 15:09 (00:00)
sukant pts/tb Wed Apr 24 12:25 - 12:25 (00:00)

wtmp begins Mon Apr 22 14:04

Just my two cents.
-Sukant

Re: user info

Peter Kloetgen — Fri, 03 May 2002 06:24:43 GMT

Hi John,

no general way, but you can check out this very easy with the following command:

cat /etc/passwd | wc -l

output is the number of lines in /etc/passwd, for each user account one line. When you do this command next time, and the number increased, new accounts where configured.

Allways stay on the bright side of life!

Peter

Re: user info

Steven Sim Kok Leong — Fri, 03 May 2002 06:37:51 GMT

Hi,

If this is a trusted system, check the timestamp of the TCB profile e.g.

# ll /tcb/files/auth/s/steven

While a home directory is optional during account creation, the created TCB profile is always created during account creation.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: user info

Thomas Schler_1 — Fri, 03 May 2002 08:09:16 GMT

Hi John, Steven,

Steven:
Unfortunately, you're not right. The timestamp of the TCB profile always is changed when you login. That's because
of the fields 'u_succhg' and 'u_unsuclog' that are
updated at each login (successful or unsuccessful).

Even using 'll -c' you obviously get not the time of the inode creation.

So in my opinion, too, there's no way to really get the
time of account creation (beside the docs of the other
authors).

Re: user info

Steven Sim Kok Leong — Fri, 03 May 2002 08:38:45 GMT

Hi Thomas,

Yes, you are right. Thanks for pointing out the mistake.

Regards.

Steven Sim Kok Leong

Re: user info

Pete Randall — Fri, 03 May 2002 09:37:04 GMT

John,

How about putting a file (let's call it $home/.000file) in their $HOME as part of the create process and make it non-writable, non readable, invisible (000)? If you use sam to add users, you can customize it to add this step. Then you could always check the date on $home/.000file.

Pete

Re: user info

Duncan Edmonstone — Fri, 03 May 2002 09:47:15 GMT

Good idea Pete, but any file in a users home directory isn't going to be un-touchable by that user - they own the directory itself, and so have permission to remove files in that directory.

They can't read the file, or write to it, but they can delete it...

HTH

Duncan

Re: user info

John Carr_2 — Fri, 03 May 2002 10:01:14 GMT

Hi

I reckon the closest is the wtmp/utmp files providing they have not been purged.

For the future I would create a file using the following command

touch /etc/skel/.creation

now all new user accounts creted will have a file in the home directory with the cretaion date.

Re: user info

Pete Randall — Fri, 03 May 2002 10:41:36 GMT

Good point Duncan. However, if root owned it . . .

Pete

Re: user info

Pete Randall — Fri, 03 May 2002 10:46:06 GMT

Well slap me silly, they can still remove it !! Thanks, Duncan, for teaching me something I should have known.

I still think that this approach will work 99% of the time. Most users wouldn't even see the file let alone remove it.

Oh well.
Pete

Re: user info

Donny Jekels — Mon, 25 Aug 2003 15:18:21 GMT

look at the logins command.

it provides everything you need.