How to List Users in Linux (All Commands)

Short reference

Quick way: cat /etc/passwd

Run the command cat /etc/passwd to list all accounts on the system, one per line in format username:x:UID:GID:comment:home:shell. This includes both accounts created by humans and all the system/service accounts (like www-data, sshd, nobody and many others).

cat /etc/passwd

Please note, that it is the full list of accounts, although seldom corresponding to the subset of interest—human users—that we talk about in further sections.

More portable way: getent passwd

Whereas cat /etc/passwd lists only the accounts stored in the local file, accounts that are authenticated through LDAP, NIS or any other directory service won't be listed here. The command getent passwd queries all the sources specified in /etc/nsswitch.conf (local file, LDAP, NIS and etc.) and outputs the result in the same format:

getent passwd

If there is any doubt about the presence of centralized authentication on some server, it is better to use getent passwd, because the output of the command is the same as /etc/passwd on servers without directory services and is more full on those with directory services.

List only usernames

Both the commands below remove unnecessary fields and give usernames one per line:

cut -d: -f1 /etc/passwd
compgen -u

Explanation: cut -d: -f1 extracts the first colon-separated field from /etc/passwd. compgen -u is a built-in Bash command that does exactly the same thing but doesn't require you to know the file format, very useful for script writers who don't want to parse /etc/passwd manually.

List only human users, system accounts excluded

Filter by UID to differentiate human users from services:

awk -F: '$3 >= 1000 {print $1}' /etc/passwd

It gives the output with accounts having UID of 1000 and greater, which is a threshold used by almost all modern distributions for regular user accounts (for example, Ubuntu, Debian, Fedora 16 and later, RHEL/CentOS 6 and later). Some older systems (for example, RHEL 5 and earlier) used 500 as a threshold, just adjust it accordingly in case you work with legacy systems.

Check UID and groups of a particular user

After listing all the accounts and choosing a certain one, the command id gives all the information for one user in one line:

id username

The output contains UID, primary GID and all groups to verify if a permissions problem relates to the group membership.

List currently logged in users

cat /etc/passwd lists all the accounts on the system, while who gives the list of currently logged in users only:

who

Every line shows the username, associated terminal or pseudo terminal and the time when the session was started. The w command gives more detailed information on the same list of sessions.

Look into user login history

The who command gives the information about current sessions. To see the information about previous sessions, including the ended ones, run:

last

The command gives the history of logins and shows the start time, duration and terminal or remote address for each session. Thus, you can confirm the last login time rather than current.

One command to rule them all: lslogins

Most of the commands above solve the particular task. The command lslogins, which is a part of the util-linux package (comes preinstalled on almost all modern systems) solves the major of them in one query. Running lslogins without any parameters gives the list of all system accounts with UID, GID, home directory, shell and account status in one table.

lslogins

Some options make the output suitable for your particular purpose:

lslogins -u
lslogins -s
lslogins -L

• The -u (or --user-accs) option limits the output to regular user accounts.

• The -s (or --system-accs) option shows system accounts; by default those with a UID between 101 and 999.

• The -L (or --last) option adds the last login session for every account, thus combining information that usually requires separate invocation of the last command. If you need to remember just one command of this group, then lslogins is the best choice.

In cases like audit of the server access rights on an inherited server or securing the server before its handing off to someone else, this set of commands is one of the first checks you usually perform. The users with root privileges can run these commands on OrbitServers VPS and bare-metal server instances from the first login.