How to find User Account Information in Linux?

In this article, we will be looking at the various commands that give us valuable information on the users’ accounts In Linux-based operating systems. We will go through various commands like id, group, whoami, finger, getent, grep, lslogins, users, who, and so on. So pay attention, take notes, and read right till the end.

Why do we need user account information?

Before addressing the question of what, let us discuss why we need user account information. Well, we all know that Linux is a multiuser platform. Therefore, we must manage these users properly to keep the system productive, organized, and functional. 

The system administrator must know all the users using the system to manage them and their permissions. Therefore, tracking all the users is a significant job. We can use multiple tools, which we will look at in depth in this article. We also know that everything in Linux is a file, and all of the information about users is contained in the “/etc/passwd” file. The respective hash passwords are present in the “/etc/shadow” file. 

In a nutshell, it is an essential job of system administrators to monitor the users in the system. To do this task, we have many monitoring commands like d, group, whoami, finger, getent, grep, lslogins, users, who, lastb, lastlog, w, and more. 

What is the user account information?

The user account information contains various information like the user name, the time of login, last time of login, account expiry date, password expiry date, idle time, login time, email address, plan, project, pgpkey, and countless more information! It only depends on what you are capable of asking Linux.

Let us look at some user information look-up commands :

1. Linux Id command

The id command is a command-line-based user information look-up command that prints out the user and group names and numeric ids of the current user or any other user on the server. We can combine the id command with various options to get specific information. The id command shows the following information:

• User name and real user id.
• User UID.
• Groups associated with a user.
• Groups a user belongs to.
• Security context of the current user.

Syntax of the id command in Linux

The syntax of the id command is

id <options> <user>.

Options used with the id command

The options that are used with the id command are:

1. -g – Print only the effective group id.

2. -G – Print all Group ids.

3. -n – Prints name instead of the number.

4. -r – Prints real ID instead of numbers.

5. -u – Prints only the effective user ID.

6. –help – Prints the help menu of the id command.

7. –version – Prints the information about the version of the id command.

2. Linux Groups command

The ‘groups command’ is a command-line-based user information look-up command that prints the names of the primary groups and any supplementary groups for each of the given username. If no username is given, it considers the current process. If you give more than one name, the groups command prints each user’s name in the list of that user’s groups. 

Syntax of the groups command in Linux

The syntax of the groups command is

groups <user>.

3. Linux Finger command

The finger command is a command-line-based utility in Linux-based operating systems that gives the details of all the users that are currently logged in. There are various user information look-up commands like “whoami”, “who”, “lastlog”, “users”, and more. The finger command is one such user information look-up command.

Installing the finger command in Linux

The finger command does not come preinstalled in most Linux distributions. Don’t panic. You can always download it with the commands below regarding your Linux distro.

• Debian-based distros – sudo apt install finger
• RHEL-based distros – sudo yum install finger
• Fedora-based distros – sudo dnf install finger

Syntax of the finger command

The syntax of the finger command is:

finger <options> <user>

Options used with the finger command 

Unlike most of the commands in Linux, the finger command has only a few options associated with it. Let us take a brief look at each one of them:

a. -s

This option displays various information like the user’s login name, real name, and terminal name and writes status,, office location, idle time, login time, and office phone number.

b. -l

This option prints various additional information to the one printed by the option “-s”. This additional information consists of the user’s home directory, home phone number, login shell, mail status, and also the contents of the files from the user’s home directory like “.plan”, “.project”, “.pgpkey” and “.forward”.

c. -p

This option prevents the option “-l” of the finger command from displaying the contents of the  “.pgpkey”, “.project”, and “.plan” files from the user’s home directory.

d. -m

This option prevents the matching of usernames. 

Output of the finger command

To display the information of a specific user, run the finger command followed by the name of the user you are searching for as shown:

finger <user>

Let us understand the information displayed by the finger command:

• Login – Shows the login name of a user
• Name – Shows the full name of a user
• Directory – Shows the home directory of a user
• Shell – Shows the shell used by a user
• On since – Shows the user’s logged-in time and date
• Mail – Shows the mails of a user if there are any to be shown
• Plan – Shows the plans of a user

4. Linux Getent command

The getent command is a command-line-based user information look-up command that helps the user get the entries in several important text files called databases. These databases include “passwd” and the “group”, which store the user information. 

Syntax of the getent command

The syntax of the getent command is:

getent <database> <key>

Options used with the getent command 

The options used with the getent command are:

• -s – Overrides all the databases with the specified service.
• -S – Override only the specified databases with the specified service. The option may be used multiple times, but only the last service for each of the databases will be used.
• -i – disables IDN encoding in the look-ups for hosts/getaddrinfo.
• –help – Prints the help menu of the getent command.
• –usage – Prints a short usage summary and exit.
• -V – prints the information regarding the getent command.

5. Linux Grep command

Grep command is a LINUX command which stands for Global regular expression print. The grep command searches a file(s) for a word(s), sentence(s), or any pattern of words or characters and displays all the lines that contain the same. You can use this command to search for various user-related information too. For example, I can search for a specific user name in the passwd database as shown below:

Syntax of the grep command

The syntax of grep is:

grep <options> "word/sentence" <file(s)>.

6. Linux Lslogins command 

The lslogins command is a command-line-based user information look-up command that lists all users’ logins. For example, pair the lslogins command with the option “-u” to print only the logins of the system users (which start from UID 1000), as shown below:

7. Linux Users Command

The ‘users command’ is a command-line-based user information look-up command that shows the usernames of users that are currently logged in to the current host.

8. Linux Who command

The ‘who command’ is a command-line-based user information look-up command that shows the following information:

• Time of last system boot.
• Current run level of the system.
• List of logged-in users and more.

Syntax of the who command

The syntax of the who command is

who <options> <filename>.

9. Linux W command

The w command is a command-line-based user information look-up command that shows the users logged on and what they are doing. In addition, it shows other information like how many users are currently logged on, how long the system has been running, and more. 

Syntax of the w command

The syntax of the w command is

w <options> <user>.

Options used with the w command 

The options used with the w command are:

• -h – Does not print headers.
• -u – Ignores current process username.
• –s – Print in short format.
• -f – show remote hostname field.
• -o – Display in the old format.
• -i – Display the IP address instead of the hostname.
• -V – Prints information about the version of the w command.

10. Linux Whoami command

The w command is a command-line-based user information look-up command that displays the current user’s username. 

11. Linux Lastlog command

The lastlog command is a command-line-based user information look-up command that prints the last login times for system accounts. This login information is read from the file /var/log/lastlog.

Syntax of the lastlog command

The syntax of the lastlog command is

lastlog <options> <argument>.

Options used with the lastlog command 

The options used with the lastlog command are:

• -b – print only lastlog records older than the specified days.
• -C – clear lastlog record of a user.
• -h – print the help menu of the lastlog command.
• -S – sets the lastlog record to the current time.
• -t – print only lastlog record more recent than the specified days.
• -u – print lastlog record of the specified username.
• -R – directory to chroot 

12. Linux Last Command

The last command is the last user monitoring command we will discuss in this article (no pun intended). This command displays the list of all users logged in and out since the creation of the file /var/log/wtmp. You can also pass more than one username as an argument to display their hostname, login in and log out time.

Syntax of the last command

The syntax of the last command is

lastlog <options> <user> <tty>.

Options used with the last command in Linux

The options used with the last command are:

• -a – display hostnames in the last column.
• -d – translate the IP number back into a hostname.
• -f – use a specific file instead of /var/log/wtmp.
• -F – print full login and logout time and dates.
• -i – display IP numbers in numbers-and-dots notation.
• -n – specify the number of lines to show.
• -R – don’t display the field containing the hostname.
• -s – display the lines since the specified time.
• -t – display the line until the specified time.
• -p – display who was present at the specified time.
• -w – display full user and domain names.
• -x – display system shutdown entries and run level changes.
• –help – print the help menu of the last command.
• –version – print the information regarding the version of the last command you are using in your system. 

Summary

You have now learned why monitoring users is essential, what is user account information, and 12 beautiful user information look-up commands, namely: id, groups, finger, getent, grep, lslogins, users, who, w, whoami, lastlog, and last.