user info

[John McDen]

Is ther way to know when was a user account created on the system??

[Sridhar Bhaskarla · Accepted solution]

General answer is no. If you didn't recycle samlog and if the user was added through SAM, you can use /usr/sam/bin/samlog_viewer to find previous logs.

-Sri

[hpuxrox]

Other than the date and time stamps on their home directorys( Which can be changes at a later time. ), I can't think of one single way.

Maybe go look at the last log or check backups to get a round about time.

-Yates

[S.K. Chan]

"First created" .. I would say no, otherwise we would not include this info in our GECOS field.

"First logon" .. possible by tracing utmp/wtmp file entries.

[Uday_S_Ankolekar]

Hello,

I don't think you can do this. But if you are sure about users .profile files from home directory were not modified then time stamp would give you general idea when it was created.

But this would be just guessing.

-USA..

[Sukant Naik]

Hi John,

Its very dificult to say when the user has been created.

But there is a command called 'last' which can give you when the user had last logged in.

# last sukant
sukant pts/tb Fri Apr 26 21:00 - 21:00 (00:00)
sukant pts/tb Fri Apr 26 20:59 - 21:00 (00:00)
sukant pts/tb Fri Apr 26 20:59 - 20:59 (00:00)
sukant pts/tb Wed Apr 24 15:08 - 15:09 (00:00)
sukant pts/tb Wed Apr 24 12:25 - 12:25 (00:00)

wtmp begins Mon Apr 22 14:04

Just my two cents.
-Sukant

[Peter Kloetgen]

Hi John,

no general way, but you can check out this very easy with the following command:

cat /etc/passwd | wc -l

output is the number of lines in /etc/passwd, for each user account one line. When you do this command next time, and the number increased, new accounts where configured.

Allways stay on the bright side of life!

Peter

[Steven Sim Kok Leong]

Hi,

If this is a trusted system, check the timestamp of the TCB profile e.g.

# ll /tcb/files/auth/s/steven

While a home directory is optional during account creation, the created TCB profile is always created during account creation.

Hope this helps. Regards.

Steven Sim Kok Leong

[Thomas Schler_1]

Hi John, Steven,

Steven:
Unfortunately, you're not right. The timestamp of the TCB profile always is changed when you login. That's because
of the fields 'u_succhg' and 'u_unsuclog' that are
updated at each login (successful or unsuccessful).

Even using 'll -c' you obviously get not the time of the inode creation.

So in my opinion, too, there's no way to really get the
time of account creation (beside the docs of the other
authors).

[Steven Sim Kok Leong]

Hi Thomas,

Yes, you are right. Thanks for pointing out the mistake.

Regards.

Steven Sim Kok Leong

[Pete Randall]

John,

How about putting a file (let's call it $home/.000file) in their $HOME as part of the create process and make it non-writable, non readable, invisible (000)? If you use sam to add users, you can customize it to add this step. Then you could always check the date on $home/.000file.

Pete

[Duncan Edmonstone]

Good idea Pete, but any file in a users home directory isn't going to be un-touchable by that user - they own the directory itself, and so have permission to remove files in that directory.

They can't read the file, or write to it, but they can delete it...

HTH

Duncan

[John Carr_2]

Hi

I reckon the closest is the wtmp/utmp files providing they have not been purged.

For the future I would create a file using the following command

touch /etc/skel/.creation

now all new user accounts creted will have a file in the home directory with the cretaion date.

[Pete Randall]

Good point Duncan. However, if root owned it . . .

Pete

[Pete Randall]

Well slap me silly, they can still remove it !! Thanks, Duncan, for teaching me something I should have known.

I still think that this approach will work 99% of the time. Most users wouldn't even see the file let alone remove it.

Oh well.
Pete

[Donny Jekels]

look at the logins command.

it provides everything you need.