1

I know the sudo adduser <username> creates:

  • a user
  • a password
  • home directory
  • GECOS (as optional)

Suppose were executed the following commands in the same machine but in different points of time according the version of Ubuntu itself as follows:

  • sudo adduser commanderkeen when Ubuntu Desktop was 18:04
  • sudo adduser tron when Ubuntu Desktop was 20:04
  • sudo adduser captainfuture when Ubuntu Desktop was 22:04

How would be possible to know under what specific Ubuntu version was created a specific user? For example: for the tron user should be indicated that was created when Ubuntu was 20.04. Is possible accomplish this goal?

Manuel Jordan
  • 2,082

2 Answers2

6

There is no log of user creation and what Ubuntu it was created with. Ubuntu version is just a reference in /etc/lsb-release, If you need that you would need to code something to do that (and that would be for new users created from that moment.

In regards to the date of a user created. (This is from a new install yesterday):

/var/log/auth.log has an account of users activity.

2024-05-02T17:42:34.259561+00:00 schijwereld useradd[2391]: 
new user:name=rinzwind, UID=1000, GID=1000, 
home=/home/rinzwind, shell=/bin/bash, from=none

If that file never got deleted or truncated it will have a line with "new user" and the command used (here useradd) with the exact date and time for all created users. If it was deleted or truncated you would need to rely on backups to restore older versions of this file.

If the password of the user never changed chage will work to:

$ chage -l rinzwind
Last password change                    : May 02, 2024
Password expires                    : never
Password inactive                   : never
Account expires                     : never
Minimum number of days between password change      : 0
Maximum number of days between password change      : 99999
Number of days of warning before password expires   : 7

but it is not "created". It was when the password was last changed do any upgrades after that date are not the moment the user was created. auth.log would be more useful for that.

Rinzwind
  • 309,379
2

As other comments implied, you could try looking at metadata for the home directory, e.g.:

:; stat ~
  File: /home/jim
  Size: 4096            Blocks: 8          IO Block: 4096   directory
Device: 810h/2064d      Inode: 664         Links: 43
Access: (0755/drwxr-xr-x)  Uid: ( 1000/     jim)   Gid: ( 1000/     jim)
Access: 2024-04-29 20:28:07.102535227 +0200
Modify: 2024-05-02 13:16:18.824761686 +0200
Change: 2024-05-02 13:16:18.824761686 +0200
 Birth: 2022-08-03 09:15:16.581359797 +0200

The "Birth" line says when this directory was created in this filesystem (meaning that if you e.g. migrated from machine to machine by rsync or similar copying technique, or restored from backups, this can be the moment of creating a new copy of the directory).

Then as you have a date, you can guess or look up in logs etc. (as suggested by other answers) the release you could have been running back then.

One point to check is if your OS has and uses ZFS or similar snapshot-capable filesystem and upgrade routines making use of snapshots (to keep the pre-upgrade state intact in case you need to roll back). In that case your historically layered storage can have the information about which release you ran at what time range. Essentially another twist on "look at your backups" idea from earlier posts, but here you are more likely to have one in fact (everyone knows they should use backups, but few home users actually invest into having those - and retaining for years).

Jim Klimov
  • 168