Some other very useful tools that we have starts with the command,
last. Using last, we're able to show the last reboots, as well as
the last login for users. Using lastlog, we see for all users the
last time they logged in, but many accounts are service accounts and
as such, don't log in.
What we can do is filter those so we don't see those.
If we send our output to grep, ‑v reverses the search, and then if we say don't
show me lines where they contain Never logged in. Now that's then showing the
command, but also some of the filters that we can use from the command line. In
the same way, we can go through and take a look at the awk command. Here we're
creating a list of users who have a user ID of 1000 or higher, so really our
standard user accounts. For each one of the usernames that we find, we go
through then and run a chage, go through and list the password aging
information, so we're able to go through and see the last password change date.
So these are really good for us to practice and take a look at, so let's move
out to our command line and start listing our users, their login times, and
the password last changed date. And here we are, back on our Ubuntu system,
and we can go through and start looking at how we can start listing vital
information about our users.
The last command is always very good, and obviously this is a new system
so we don't have a lot of activity, but we can see when there was a
system boot and we can see then recent logins for our users. Now we've
only had the vagrant user log in in this session. If we want more
information we can use the lastlog command, and this then lists all of
our user accounts, all of the users that we can find.
Now, many are service accounts so have never logged in.
So this is very simple, we can start filtering on these lines.
So, using our pipe command we can use grep and ‑v, so we reverse our
search, so we end up saying, don't show me lines. And if we asked not
to be shown lines that begin with Never logged in, as we then go
through and look at these lines including Never logged in, we're able
then to see our vagrant count.
These are the only ones who has, if you like, logged in. Now we're
assuming that most of the accounts that we are looking at will have
logged in if they're standard accounts, but we might have a whole
load of standard accounts that have never logged in, and maybe we
need to know about that.
Sure, system accounts are not logging in frequently,
but if we've got user accounts that aren't logging in, then we
can dig into this, and this is where awk can be really useful. If
we look inside of our passwd file,
we can then go through and use awk ‑F, as a field delimiter we can use a
colon, we can go through and put a little bit of an if statement, and we
can go through and specify if $3 >= 1000.
So it's really looking at our user IDs in $3 and field 3, which are 1000 or
higher standard users. We can then go through and print out $1,
the username. As we then go through and take a look at this from our
etc/passwd filed, we're able to see then that this relates to our nobody and
vagrant user. Now all of this then becomes really useful and we can start
putting this to use. Now we can just move that command to the top of the
screen for ease, and I can use then a for loop, for u, so variable I use for
my usernames, in my list.
I can dynamically create the list with my awk command, and we just need to make
sure it's inside of parentheses and is prefaced by the dollar, ;do just allows
me to go into my looping structure, and we can then go through and maybe echo
out the username that we are working with.
So that's our temporary variable that we've created, $u. We can use the
lastlog command, but rather than looking for all users,
we can use ‑u and then $u, so for each user, remember, we're only
looking at our standard users now, so with a user ID of 1000 or
higher. So that now becomes really useful.
We can pick up on those standard users that have never logged in.
We can then go through and look at our password last change date, so
chage ‑l to list the password aging information, and $u.
We only want to see our last password change so we can look for lines
beginning with Last, and with that done, we can put in the keyword, done,
that will close my looping structure and the commands will then execute,
one for each member of our list.
So we see our nobody, vagrant, and Ubuntu user.
We can see that nobody has never logged in, vagrant has logged
in, but Ubuntu as well has never logged in.
But additionally now, we can also go through and see our password
last change date, so we're getting a lot more information, but
information that's really giving us focus on the users we are interested in, our standard users.