How can you tell when a Unix account was created?

[Craig Johnson_1]

Is there a bulletproof method of doing so? Sam logs aren't because you don't have to use Sam. /home directory date and contents won't work either. Any ideas?

[Grayh]

cat /etc/passwd

[Grayh]

#cat /etc/passwd

[James R. Ferguson]

Hi Craig:

Only by inference. First, there is no such attribute/property as a "creation" timestamp in Unix. You have a modification timestamp ('mtime') and that would coincidently equal the creation moment until such time as the file in question was changed; or until such time (for a directory) as a file was added or removed from the directory.

Regards!

...JRF...

[Pete Randall]

Bulletproof??? No.

Looking at /etc/passwd isn't going to tell you anything because there are no date stamps. The closest you can come is looking at the date/time stamps on the user's home directory but, as Jim says, there's no guarantee with that either.


Pete

[Tim Nelson]

For the future.

Add an audit log to your user creation/removal script.

[Craig Johnson_1]

We have an audit log but it's ugly (does a diff on /etc/passwd every single day, amongst other things). I was hoping for a more elegant solution.

There are five senior admins here and none of us could come up with anything better.

[Tim Nelson]

Now you have 8 more without a concreate solution. Must be no solution.

Is all your user admin done via SAM ? If so, do you delete the SAM logs ?

Do you clear out your wtmp files ? First entry for each user could be close to their creation time.

Otherwise back to a better solution for going forward.

Create your user admin scripts with a nicely formatted audit/log file.

[Peter Nikitka]

Hi,

attached is my audit program for logging changes in /etc/passwd + /etc/shadow.
Logdirectory $PWwdir (default: /root/pw) needs creation/modification before the first run.
My crontab runs this in a 4hour frame - your milage may vary.
Note that my 'key' is the UID - so UID-changes result in NEW/DEL records.

mfG Peter

[Torsten.]

Bulletproof?

This is bulletproof:

http://hp.feedroom.com/index.jsp?fr_story=4771fb6e6ae03e45534d08bfbe17cade6656025b&fr_chl=d9138bf1d80fad18e3bfa58c2dc62ae5716c10df

off topic, anyway.

Have a funny friday!

[Court Campbell]

we have a script that we use to create users and delete users. One of the things the scripts do is put the user account info and a creation/deletion timestamp. Or you could switch to something like openLDAP which may store that info.

[Court Campbell]

Torsten,

That was awesome.

[TTr]

The last two places I worked we used scripts, similar to what everybody else mentioned, to create and delete users. The scripts put detailed entries in logs for user accounting. The /etc/password file is a simple text file and not a database table with lots of information in it.