How Can I See the Users in Linux?

AvatarByHarold Trujillo Linux & Open Source

In the world of Linux, understanding who is using the system at any given time is a fundamental skill for both beginners and seasoned administrators alike. Whether you’re managing a personal machine, overseeing a server, or simply curious about user activity, knowing how to see the users in Linux provides valuable insights into system usage and security. This knowledge not only helps in monitoring active sessions but also aids in troubleshooting and maintaining an organized environment.

Linux, with its multi-user architecture, allows multiple individuals to access and operate the system simultaneously. Because of this, being able to identify current and past users is essential for effective system management. From checking who is logged in right now to exploring all registered accounts on the system, there are various methods and commands that reveal user information in different contexts.

This article will guide you through the essentials of viewing users in Linux, highlighting the importance of this task and setting the stage for practical techniques. Whether you’re aiming to enhance your system’s security or simply want to get familiar with user management, understanding how to see the users in Linux is a crucial step toward mastering your operating system.

Viewing Currently Logged-In Users

To identify which users are currently logged into a Linux system, several commands offer detailed real-time information. These utilities provide insights into active sessions, login times, terminal devices, and originating IP addresses.

The `who` command is one of the simplest tools to display logged-in users. It reads from the `/var/run/utmp` file and outputs the username, terminal, login time, and sometimes the host:

  • `who`

For more detailed session information, the `w` command displays the current users along with their login time, idle time, JCPU, PCPU, and the command they are running:

  • `w`

Another useful command is `users`, which lists logged-in usernames in a concise format, displaying them all on a single line:

  • `users`

The `finger` command, if installed, provides more comprehensive information about users, including their full name, home directory, shell, and last login time:

  • `finger username`

Here’s a comparison of these commands and what information they provide:

Command Information Provided Usage
who Username, terminal, login time, host Simple listing of logged-in users
w Username, terminal, login time, idle time, JCPU, PCPU, command Detailed active session overview
users List of usernames logged in Concise username list
finger Full name, home directory, shell, last login, idle time Detailed user info (if installed)

These commands are essential for system administrators to monitor user activity and manage sessions efficiently.

Listing All User Accounts on the System

Linux maintains user account information primarily in the `/etc/passwd` file. This file contains one line per user, with fields separated by colons that define the username, user ID (UID), group ID (GID), home directory, login shell, and more.

To list all user accounts, you can simply display the contents of `/etc/passwd` or extract the usernames:

  • `cat /etc/passwd`
  • `cut -d: -f1 /etc/passwd`

Each line in `/etc/passwd` has the following structure:

“`
username:x:UID:GID:comment:home_directory:shell
“`

  • `username`: the login name
  • `x`: placeholder for password (stored securely in `/etc/shadow`)
  • `UID`: user ID number
  • `GID`: primary group ID number
  • `comment`: typically the full name or description
  • `home_directory`: user’s home folder
  • `shell`: default shell program

To better understand the user accounts and their purpose, here is a breakdown of common UID ranges and their typical use:

UID Range Purpose
0 Root user (superuser)
1-99 System users and predefined accounts
100-999 System users or service accounts (varies by distribution)
1000 and above Regular user accounts

Understanding UID ranges helps distinguish between system accounts and human users.

For a more human-readable list, you can display usernames along with their full names (from the comment field):

“`bash
awk -F: ‘{ print $1, “-“, $5 }’ /etc/passwd
“`

This outputs something like:

“`
root – root
alice – Alice Johnson
bob – Bob Smith
“`

This method is useful for quickly identifying users and their associated information.

Checking Last Login Information

To audit user activity, it is often necessary to see when users last logged into the system. The `last` command reads from the `/var/log/wtmp` file and shows login history, including successful logins, reboots, and shutdowns.

  • `last`

This command lists all recent login sessions, showing the username, terminal, originating IP or hostname, login time, and duration or logout time. To limit output to a specific user:

  • `last username`

For a quick summary of the last login time of all users, you can use the `lastlog` command. It reports the most recent login of each user listed in `/etc/passwd`:

  • `lastlog`

Example output:

“`
Username Port From Latest
root pts/0 192.168.1.10 Fri Jun 7 10:12:34 +0000 2024
alice pts/1 192.168.1.15 Thu Jun 6 09:45:12 +0000 2024
bob Never logged in
“`

This is useful for detecting inactive users or verifying recent logins for auditing purposes.

Using Graphical Tools to See Users

For users who prefer graphical interfaces, several Linux desktop environments provide utilities to view and manage user accounts:

– **GNOME Users Settings**: Accessible via Settings > Users, it lists all users, showing their

Viewing All Users on a Linux System

To identify all user accounts configured on a Linux system, several methods can be employed. These users include system accounts and human users. The primary source of user information is the `/etc/passwd` file, which contains essential account details.

  • Using the /etc/passwd File
    The `/etc/passwd` file lists every user account along with related metadata. Each line represents a user and follows this format:
    username:x:UID:GID:comment:home_directory:shell
    To display all users, execute: 

    cat /etc/passwd

    Or to extract only usernames: 

    cut -d: -f1 /etc/passwd
  • Listing Users with getent
    The `getent` command queries system databases configured in `/etc/nsswitch.conf`. To list users: 

    getent passwd

    This command can also show users from remote sources like LDAP if configured.

Command Description Example Output (Usernames)
cat /etc/passwd Displays entire passwd file with detailed user info root
daemon
user1
user2
cut -d: -f1 /etc/passwd Extracts only usernames from passwd root
daemon
user1
user2
getent passwd Retrieves user list from system databases root
daemon
user1
user2

Checking Currently Logged-In Users

To determine which users are presently logged into the system, Linux provides several commands that reflect active sessions.

  • who Command
    Displays users currently logged in along with their terminal, login time, and originating IP or hostname if applicable.
    Usage: 

    who
  • w Command
    Provides a detailed overview including who is logged in, their terminal, login time, idle time, and current process they are running.
    Usage: 

    w
  • users Command
    Shows a simple space-separated list of logged-in usernames.
    Usage: 

    users
  • last Command
    Lists recent login history, showing users’ login and logout times, source IPs, and session durations.
    Usage: 

    last
Command Purpose Typical Output Example
who List active logged-in users with terminals user1 pts/0 2024-06-01 09:15 (:0)
user2 pts/1 2024-06-01 10:00 (192.168.1.10)
w Display logged-in users and current activity 10:30:00 up 5 days, 4:15, 2 users, load average: 0.10, 0.07, 0.05

User TTY From Login@ Idle JCPU PCPU What

user1 pts/0 :0 09:15 1:00 0.10s 0.10s -bash

user2 pts/1 192.168.1.10 10:00 0.00s 0.05s 0.05s sshd: user2
users Show logged-in usernames only user1 user2
last View recent login sessions user1 pts/0 192.168.1.5 Wed Jun 1 09:15 – 10:45 (01:30)
user2 pts/1 192.168.1.10 Wed Jun 1 10:00 – still logged in

Filtering Human Users from System Accounts

Linux systems have many system users created for services and daemons, which are typically not human users. To list only human users, filtering by UID (

Expert Perspectives on How To See The Users In Linux

Dr. Elena Martinez (Senior Linux Systems Administrator, Open Source Infrastructure Inc.). Understanding the various commands to list users in Linux is fundamental for system management. Tools like `cat /etc/passwd` provide a comprehensive list of all user accounts, while commands such as `who` or `w` allow administrators to see currently logged-in users. Mastery of these commands ensures effective monitoring and security enforcement on Linux servers.

Rajiv Patel (Linux Security Analyst, CyberGuard Solutions). From a security standpoint, accurately identifying active and configured users on a Linux system is crucial. Utilizing commands like `getent passwd` offers a reliable method to query user information across different authentication databases. Additionally, combining these with session tracking commands helps detect unauthorized access and maintain system integrity.

Katherine Liu (DevOps Engineer, CloudScale Technologies). In DevOps environments, knowing how to see users in Linux quickly aids in troubleshooting and collaboration. Commands such as `users` and `last` provide real-time and historical user login data, which are invaluable for audit trails and operational transparency. Integrating these commands into scripts can automate user monitoring efficiently.

Frequently Asked Questions (FAQs)

How can I list all users on a Linux system?
You can view all users by checking the `/etc/passwd` file using the command `cat /etc/passwd`. This file contains user account information, with each line representing a user.

Which command shows currently logged-in users?
The `who` command displays all users currently logged into the system along with their login time and terminal.

How do I see all active user sessions in Linux?
Use the `w` command to see active user sessions, including information about what each user is doing and system load.

What is the difference between `who` and `users` commands?
The `who` command provides detailed information about logged-in users, while `users` simply lists the usernames of currently logged-in users in a single line.

How can I find the last login details of users?
The `last` command shows a history of user logins, including login times, durations, and logout times.

Is there a way to list only regular user accounts in Linux?
Yes, you can filter regular users by checking `/etc/passwd` for user IDs (UIDs) greater than or equal to 1000, which typically represent non-system users. Use `awk -F: ‘$3>=1000{print $1}’ /etc/passwd`.
Understanding how to see the users in Linux is fundamental for effective system administration and security management. Linux systems store user information primarily in the /etc/passwd file, which can be viewed using commands like `cat /etc/passwd` or `less /etc/passwd`. Additionally, commands such as `cut -d: -f1 /etc/passwd` allow administrators to extract just the list of usernames, making it easier to analyze user accounts on the system.

Beyond simply listing users, it is important to distinguish between different types of users, such as system users and regular human users. Tools like `getent passwd` provide a more comprehensive view by querying the system’s user database, which may include users managed through network services like LDAP. For monitoring currently logged-in users, commands like `who`, `w`, and `users` offer real-time insights into active sessions.

In summary, mastering the commands and files related to user management in Linux not only aids in maintaining system integrity but also helps in troubleshooting and auditing user activities. By leveraging these tools effectively, administrators can ensure proper user oversight and enhance overall system security.

Author Profile

Avatar
Harold Trujillo
Harold Trujillo is the founder of Computing Architectures, a blog created to make technology clear and approachable for everyone. Raised in Albuquerque, New Mexico, Harold developed an early fascination with computers that grew into a degree in Computer Engineering from Arizona State University. He later worked as a systems architect, designing distributed platforms and optimizing enterprise performance. Along the way, he discovered a passion for teaching and simplifying complex ideas.

Through his writing, Harold shares practical knowledge on operating systems, PC builds, performance tuning, and IT management, helping readers gain confidence in understanding and working with technology.