Friday, January 15, 2021

Looking into Linux user logins with lslogins

One convenient way to list details about user logins on a Linux system is to use the lslogins command. You'll get a very useful and nicely formatted display that includes quite a few important details.

On my system and likely most others, user accounts will start with UID 1000. To list just these accounts rather than include all of the service accounts like daemon, mail and syslog, add the -u option as shown in the example below.

$ sudo lslogins -u
  UID USER                PROC PWD-LOCK PWD-DENY LAST-LOGIN GECOS
0 root 151 0 0 root
1000 shs 68 0 0 12:35 Sandra H-S 1001 nemo 0 0 0 2021-Jan05 Nemo Demo,,, 1002 dbell 0 0 1 Dory Bell 1003 shark 2 0 0 7:15 Sharon Hark 1004 tadpole 0 0 0 2020-Dec05 Ted Pole 1005 eel 0 0 0 2021-Jan11 Ellen McDay 1006 bugfarm 0 0 0 2021-Jan01 Bug Farm 1008 dorothy 0 0 1 Dorothy Reuben 1012 jadep 0 0 1 2021-Jan04 Jade Jones 1013 myself 0 0 0 2021-Jan12 My Self 1014 marym 0 0 0 2020-Mar20 Mary McShea 1017 gijoe 0 0 0 GI Joe 65534 nobody 0 0 1 nobody

What the lslogins command does is grab relevant information from system files such as /etc/passwd, /etc/shadow and /var/log/wtmp and lay it out in a format like that shown below. If you run this command without using sudo, you will not be able to retrieve all of the information shown. Non-privileged accounts won't have access to all of the files that are needed.

To read this article in full, please click here


Thanks to Sandra Henry-Stocker (see source)

No comments:

Post a Comment