Is there any way to determine when a user account was first created? 

sinister wrote:
> Is there any way to determine when a user account was first created? 
> 
> 

a good guess might be the creation time of the home directory - although
this might be wrong if the directory was recreated during a restore from
a backup...

"Thomas Maier-Komor" <maierkom@lpr.e-technik.no-spam.tu-muenchen.de> wrote 
in message news:cloa6i$j7h$1@wsc10.lrz-muenchen.de...
> sinister wrote:
>> Is there any way to determine when a user account was first created?
>
> a good guess might be the creation time of the home directory - although
> this might be wrong if the directory was recreated during a restore from
> a backup...

Right, I thought of that.  Also, some of the users on my system have home 
dirs that don't actually exist anymore.  A sure sign they either never used 
the account (and that the previous admin didn't create them properly), or 
that the account is so old the directory structure changed a lot in the 
meantime.  But I was wondering if I could somehow get a precise date...

Thanks,

S

Thomas Maier-Komor wrote:
 > sinister wrote:
 >
 >> Is there any way to determine when a user account was first
 >> created?
 >>
 >
 > a good guess might be the creation time of the home directory

How would you propose to find the creation time of the home directory
(or indeed of any file on a UFS filesystm)?

-- 
Tony

On Wed, 27 Oct 2004 15:40:59 +0100, Tony Walton wrote:

> How would you propose to find the creation time of the home directory
> (or indeed of any file on a UFS filesystm)?

[duhring]$ ls -l .bash_profile
lrwxrwxrwx 1 root other    7 Aug 23 21:17 .bash_profile -> .bashrc
[duhring]$ ls -l /etc/chroot
lrwxrwxrwx 1 root root  18 Aug 23 19:42 /etc/chroot -> ../usr/sbin/chroot

Dave Uhring wrote:
> On Wed, 27 Oct 2004 15:40:59 +0100, Tony Walton wrote:
> 
> 
>>How would you propose to find the creation time of the home directory
>>(or indeed of any file on a UFS filesystm)?
> 
> 
> [duhring]$ ls -l .bash_profile
> lrwxrwxrwx 1 root other    7 Aug 23 21:17 .bash_profile -> .bashrc
> [duhring]$ ls -l /etc/chroot
> lrwxrwxrwx 1 root root  18 Aug 23 19:42 /etc/chroot -> ../usr/sbin/chroot
> 

Sorry Dave, I'm not with you there at all.

-- 
Tony

Tony Walton wrote:
> Thomas Maier-Komor wrote:
>  > sinister wrote:
>  >
>  >> Is there any way to determine when a user account was first
>  >> created?
>  >>
>  >
>  > a good guess might be the creation time of the home directory
> 
> How would you propose to find the creation time of the home directory
> (or indeed of any file on a UFS filesystm)?
> 

well, I guess you are right that the creation time is not available,
but on the other hand i am not aware that the modification time
is updated for directories after their creation? Am I wrong?

2004-10-27, 17:30(+02), Thomas Maier-Komor:
[...]
> well, I guess you are right that the creation time is not available,
> but on the other hand i am not aware that the modification time
> is updated for directories after their creation? Am I wrong?

The modification time is updated each time you modify the
directory (for instance when you link or unlink a file to it).

-- 
Stephane

On Wed, 27 Oct 2004 16:24:51 +0100, Tony Walton wrote:

> Dave Uhring wrote:
>> On Wed, 27 Oct 2004 15:40:59 +0100, Tony Walton wrote:
>> 
>> 
>>>How would you propose to find the creation time of the home directory
>>>(or indeed of any file on a UFS filesystm)?
>> 
>> 
>> [duhring]$ ls -l .bash_profile
>> lrwxrwxrwx 1 root other    7 Aug 23 21:17 .bash_profile -> .bashrc
>> [duhring]$ ls -l /etc/chroot
>> lrwxrwxrwx 1 root root  18 Aug 23 19:42 /etc/chroot -> ../usr/sbin/chroot
>> 
> 
> Sorry Dave, I'm not with you there at all.

The OS was installed at about 19:42 on 23 August - from the symlink for
/etc/chroot.

The user account was created at about 21:17 on the same day - from the
symlink in my user's home directory.

In article <cloev3$lfm$1@wsc10.lrz-muenchen.de>, Thomas Maier-Komor wrote:
> Tony Walton wrote:
>> Thomas Maier-Komor wrote:
>>  > sinister wrote:
>>  >
>>  >> Is there any way to determine when a user account was first
>>  >> created?
>>  >>
>>  >
>>  > a good guess might be the creation time of the home directory
>> 
>> How would you propose to find the creation time of the home directory
>> (or indeed of any file on a UFS filesystm)?
>> 
> 
> well, I guess you are right that the creation time is not available,
> but on the other hand i am not aware that the modification time
> is updated for directories after their creation? Am I wrong?

Yes:-)

ihg0(535)$ uname -a
SunOS xxxx 5.10 s10_58 sun4u sparc SUNW,Ultra-5_10
ihg0(536)$ mkdir test;cd test;sleep 60
ihg0(537)$ ls -ld .;ls -ldc .
drwxr-xr-x   2 ccsqihg  staff        512 Oct 27 16:53 .
drwxr-xr-x   2 ccsqihg  staff        512 Oct 27 16:53 .
ihg0(538)$ touch zzz
ihg0(539)$ ls -ld .;ls -ldc .
drwxr-xr-x   2 ccsqihg  staff        512 Oct 27 16:54 .
drwxr-xr-x   2 ccsqihg  staff        512 Oct 27 16:54 .

-- 
Ian Gregory
http://www.zenatode.org.uk/ian/

Thomas Maier-Komor wrote:
> Tony Walton wrote:
> 
>> Thomas Maier-Komor wrote:
>>  > sinister wrote:
>>  >
>>  >> Is there any way to determine when a user account was first
>>  >> created?
>>  >>
>>  >
>>  > a good guess might be the creation time of the home directory
>>
>> How would you propose to find the creation time of the home directory
>> (or indeed of any file on a UFS filesystm)?
>>
> 
> well, I guess you are right that the creation time is not available,
> but on the other hand i am not aware that the modification time
> is updated for directories after their creation? Am I wrong?

$ mkdir dir
$ cd dir
$ ls
$ ls -ld
drwxr-xr-x   2 tw25440  techies      512 Oct 27 16:52 .
$ touch foo
$ ls -ld
drwxr-xr-x   2 tw25440  techies      512 Oct 27 16:53 .
$ sleep 60; rm foo
$ ls -ld
drwxr-xr-x   2 tw25440  techies      512 Oct 27 16:54 .
$ sleep 60; touch .
$ ls -ld
drwxr-xr-x   2 tw25440  techies      512 Oct 27 16:55 .
$ touch 12251234 .
$ ls -ld .
drwxr-xr-x   2 tw25440  techies      512 Dec 25  2004 .


And so on.

-- 
Tony

Dave Uhring wrote:
> On Wed, 27 Oct 2004 16:24:51 +0100, Tony Walton wrote:
> 
> 
>>Dave Uhring wrote:
>>
>>>On Wed, 27 Oct 2004 15:40:59 +0100, Tony Walton wrote:
>>>
>>>
>>>
>>>>How would you propose to find the creation time of the home directory
>>>>(or indeed of any file on a UFS filesystm)?
>>>
>>>
>>>[duhring]$ ls -l .bash_profile
>>>lrwxrwxrwx 1 root other    7 Aug 23 21:17 .bash_profile -> .bashrc
>>>[duhring]$ ls -l /etc/chroot
>>>lrwxrwxrwx 1 root root  18 Aug 23 19:42 /etc/chroot -> ../usr/sbin/chroot
>>>
>>
>>Sorry Dave, I'm not with you there at all.
> 
> 
> The OS was installed at about 19:42 on 23 August - from the symlink for
> /etc/chroot.
> 
> The user account was created at about 21:17 on the same day - from the
> symlink in my user's home directory.
> 

The symlink was created at about 21:17 on the same day, sure. How do you 
know it wasn't deleted at 21:14 and re-created three minutes later? All 
you're looking at there is the creation date/time of a symlink.

Same  goes for the /etc/chroot symlink. You're assuming that those 
creation dates and times are reliable

# ls -l /etc/chroot
lrwxrwxrwx   1 root     other         17 Oct 27 17:00 /etc/chroot -> 
.../usr/bin/chroot

This OS was installed a *lot* more than a minute ago (I was there!)

-- 
Tony

On Wed, 27 Oct 2004 17:02:28 +0100, Tony Walton wrote:

> Dave Uhring wrote:

>> The OS was installed at about 19:42 on 23 August - from the symlink for
>> /etc/chroot.
>> 
>> The user account was created at about 21:17 on the same day - from the
>> symlink in my user's home directory.
>> 
> 
> The symlink was created at about 21:17 on the same day, sure. How do you 
> know it wasn't deleted at 21:14 and re-created three minutes later? All 
> you're looking at there is the creation date/time of a symlink.

I agree that UFS does not easily provide creation time, if at all.  But I
do know that the symlink in the user's home directory was created within a
couple of minutes after running useradd.  How much precision is necessary
to provide an answer to the OP's question?

> Same  goes for the /etc/chroot symlink. You're assuming that those 
> creation dates and times are reliable
> 
> # ls -l /etc/chroot
> lrwxrwxrwx   1 root     other         17 Oct 27 17:00 /etc/chroot -> 
> ../usr/bin/chroot
> 
> This OS was installed a *lot* more than a minute ago (I was there!)

I suppose that one could delete and create a new symlink or even that a
patch could do that.  But it's unlikely that all those symlinks in /etc
would be so affected unless done deliberately.

In article <pan.2004.10.27.16.40.36.695742@yahoo.com>,
 Dave Uhring <daveuhring@yahoo.com> wrote:

> On Wed, 27 Oct 2004 17:02:28 +0100, Tony Walton wrote:
> 
> > Dave Uhring wrote:
> 
> >> The OS was installed at about 19:42 on 23 August - from the symlink for
> >> /etc/chroot.
> >> 
> >> The user account was created at about 21:17 on the same day - from the
> >> symlink in my user's home directory.
> >> 
> > 
> > The symlink was created at about 21:17 on the same day, sure. How do you 
> > know it wasn't deleted at 21:14 and re-created three minutes later? All 
> > you're looking at there is the creation date/time of a symlink.
> 
> I agree that UFS does not easily provide creation time, if at all.  But I
> do know that the symlink in the user's home directory was created within a
> couple of minutes after running useradd.  How much precision is necessary
> to provide an answer to the OP's question?

Users modify stuff in their home directories all the time.  I would 
never assume that anything in the user's directory has been untouched 
since their account was created.  Why do you expect a symlink from 
..bash_profile to .bashrc to stay around?  I'm not even sure why these 
would be linked together in the first place, since they serve different 
purposes -- .bash_profile is only for the login shell, while .bashrc is 
for every shell.

-- 
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***

On Wed, 27 Oct 2004 20:29:39 -0400, Barry Margolin wrote:

> Users modify stuff in their home directories all the time.  I would 
> never assume that anything in the user's directory has been untouched 
> since their account was created.  Why do you expect a symlink from 
> .bash_profile to .bashrc to stay around?

That symlink, if it were even created in the first place, would be quite
unlikely to be changed.  Of course the user can change any file in his
home directory, but some are unlikely to be changed, ~/.dtprofile as an
example.

I am also aware that backup restores or simply copying with tar from one
disk to a new disk can cause errors there.  For instance,

# ls -la .??*
-rw-r--r--    1 username  sysadmin     1430 Dec  7  2002 .kshrc

Yet this system was installed Aug 23, 2004.

OTOH, how many hidden files in *your* home directory were added on the
date your user account was created and still retain the same date/time?

> I'm not even sure why these 
> would be linked together in the first place, since they serve different 
> purposes -- .bash_profile is only for the login shell, while .bashrc is 
> for every shell.

~/.bashrc is not sourced at login so apparently it is not for *every*
instance of shell invocation.

In article <pan.2004.10.28.00.52.33.589222@yahoo.com>,
 Dave Uhring <daveuhring@yahoo.com> wrote:

> On Wed, 27 Oct 2004 20:29:39 -0400, Barry Margolin wrote:
> 
> > Users modify stuff in their home directories all the time.  I would 
> > never assume that anything in the user's directory has been untouched 
> > since their account was created.  Why do you expect a symlink from 
> > .bash_profile to .bashrc to stay around?
> 
> That symlink, if it were even created in the first place, would be quite
> unlikely to be changed.  Of course the user can change any file in his
> home directory, but some are unlikely to be changed, ~/.dtprofile as an
> example.

I recall needing to customize that file occasionally.

> 
> I am also aware that backup restores or simply copying with tar from one
> disk to a new disk can cause errors there.  For instance,
> 
> # ls -la .??*
> -rw-r--r--    1 username  sysadmin     1430 Dec  7  2002 .kshrc
> 
> Yet this system was installed Aug 23, 2004.

> OTOH, how many hidden files in *your* home directory were added on the
> date your user account was created and still retain the same date/time?

When I was a heavy Unix user, I modified my dot-files pretty often, e.g. 
to add directories to my PATH, or change how I customized my prompt, etc.

Maybe there are some that are almost never changed, but off the top of 
my head I can't think which ones they would be.

> 
> > I'm not even sure why these 
> > would be linked together in the first place, since they serve different 
> > purposes -- .bash_profile is only for the login shell, while .bashrc is 
> > for every shell.
> 
> ~/.bashrc is not sourced at login so apparently it is not for *every*
> instance of shell invocation.

OK, every subshell.  Still, I don't think they should normally be linked 
together -- there's stuff you only need to do at login time, not in 
subshells.  Often .bash_profile ends with "source .bashrc" to get that 
script executed in the login shell as well.

-- 
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***

On Wed, 27 Oct 2004 21:07:49 -0400, Barry Margolin wrote:

> In article <pan.2004.10.28.00.52.33.589222@yahoo.com>,
>  Dave Uhring <daveuhring@yahoo.com> wrote:

>> That symlink, if it were even created in the first place, would be quite
>> unlikely to be changed.  Of course the user can change any file in his
>> home directory, but some are unlikely to be changed, ~/.dtprofile as an
>> example.
> 
> I recall needing to customize that file occasionally.

Mine is still original.
------------------------------------------------
Several lines involving dtstart_sessionlogfile.

DTSOURCEPROFILE=true
------------------------------------------------

The rest of the file is commented and with that last line it appears that
~/.profile is where ones modifications ought to be made.  However, if
one's login shell is csh or tcsh, how much good is that last line?

>> OTOH, how many hidden files in *your* home directory were added on the
>> date your user account was created and still retain the same date/time?
> 
> When I was a heavy Unix user, I modified my dot-files pretty often, e.g. 
> to add directories to my PATH, or change how I customized my prompt, etc.
> 
> Maybe there are some that are almost never changed, but off the top of 
> my head I can't think which ones they would be.

There is almost certainly at least one file there which has remained
unmodified.  I copied my user home directory from another system to this
one and "ls -lat .??*" clearly shows that my account was created on
Dec 7, 2002.

>> ~/.bashrc is not sourced at login so apparently it is not for *every*
>> instance of shell invocation.
> 
> OK, every subshell.  Still, I don't think they should normally be linked 
> together -- there's stuff you only need to do at login time, not in 
> subshells.  Often .bash_profile ends with "source .bashrc" to get that 
> script executed in the login shell as well.

I find that maintaining one such file is enough work even it it costs a
few microseconds on each invocation of xterm|dtterm.  YMMV.

Dave Uhring wrote:
> On Wed, 27 Oct 2004 21:07:49 -0400, Barry Margolin wrote:
> 
>> In article <pan.2004.10.28.00.52.33.589222@yahoo.com>,
>>  Dave Uhring <daveuhring@yahoo.com> wrote:
> 
>>> ~/.bashrc is not sourced at login so apparently it is not for *every*
>>> instance of shell invocation.
>> 
>> OK, every subshell.  Still, I don't think they should normally be linked 
>> together -- there's stuff you only need to do at login time, not in 
>> subshells.  Often .bash_profile ends with "source .bashrc" to get that 
>> script executed in the login shell as well.
> 
> I find that maintaining one such file is enough work even it it costs a
> few microseconds on each invocation of xterm|dtterm.  YMMV.

In my .bash_profile I might for example have:

PATH=$PATH:/mypath

I don't want that to be executed by a subshell or it becomes
$PATH:/mypath:/mypath

OK, I guess that is no big deal either but it comes down to
the fact that symlinking .bashrc to .bash_profile (or the
other way round?) just seems ugly and wrong to me, and even
if it was easier to maintain (which I don't accept) then I
would still not do it.

I guess my milage does vary!

-- 
Ian Gregory
http://www.zenatode.org.uk/ian/

On Thu, 28 Oct 2004 02:56:27 +0000, Ian Gregory wrote:

> In my .bash_profile I might for example have:
> 
> PATH=$PATH:/mypath
> 
> I don't want that to be executed by a subshell or it becomes
> $PATH:/mypath:/mypath

I *know* what I want my PATH to be and it is fully declared in ~/.bashrc
with no reference to some previously exported PATH, wherever that might
actually be.  Where is your $PATH exported before ~/.bash_profile is
executed?

> OK, I guess that is no big deal either but it comes down to
> the fact that symlinking .bashrc to .bash_profile (or the
> other way round?) just seems ugly and wrong to me, and even
> if it was easier to maintain (which I don't accept) then I
> would still not do it.

Maintenance of one file is easier than maintenance of two files.

> I guess my milage does vary!

It's *your* home directory :-)

In article <pan.2004.10.28.03.13.36.838600@yahoo.com>,
 Dave Uhring <daveuhring@yahoo.com> wrote:

> It's *your* home directory :-)

Yet you're trying to make some general assumptions about when various 
dot-files get modified!

-- 
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***

Dave Uhring wrote:
> On Thu, 28 Oct 2004 02:56:27 +0000, Ian Gregory wrote:
> 
>> In my .bash_profile I might for example have:
>> 
>> PATH=$PATH:/mypath
>> 
>> I don't want that to be executed by a subshell or it becomes
>> $PATH:/mypath:/mypath
> 
> I *know* what I want my PATH to be and it is fully declared in ~/.bashrc
> with no reference to some previously exported PATH, wherever that might
> actually be.  Where is your $PATH exported before ~/.bash_profile is
> executed?

It could be done in /etc/profile, the standard place where
bash looks first (my above example was hypothetical).

>> OK, I guess that is no big deal either but it comes down to
>> the fact that symlinking .bashrc to .bash_profile (or the
>> other way round?) just seems ugly and wrong to me, and even
>> if it was easier to maintain (which I don't accept) then I
>> would still not do it.
> 
> Maintenance of one file is easier than maintenance of two files.

I have some commands in one file and some in another whereas you
have them all in one. However, when I want to make a change I only
need to edit the appropriate one - it is not like I have to keep
them synced or anything. When I set up a new machine I might have
to copy both files over whereas you would only have to copy one
but you would *also* have to create the symlink.

So I don't think the maintenance issue is at all clear cut but
I don't want to follow up again so I will just relent and say
that your way may be marginally easier:-)

>> I guess my milage does vary!
> 
> It's *your* home directory :-)

An Englishman's home directory is his castle:-)

-- 
Ian Gregory
http://www.zenatode.org.uk/ian/

On Thu, 28 Oct 2004 04:20:43 +0000, Ian Gregory wrote:

> Dave Uhring wrote:

>> I *know* what I want my PATH to be and it is fully declared in ~/.bashrc
>> with no reference to some previously exported PATH, wherever that might
>> actually be.  Where is your $PATH exported before ~/.bash_profile is
>> executed?
> 
> It could be done in /etc/profile, the standard place where
> bash looks first (my above example was hypothetical).

Yes, it could be assuming that one's shell is a derivative of sh, but

Sun Microsystems Inc.   SunOS 5.9       Generic May 2002
[duhring]$ grep PATH /etc/profile
export LOGNAME PATH

So where does your $PATH originate?

On Thu, 28 Oct 2004 00:03:54 -0400, Barry Margolin wrote:

> In article <pan.2004.10.28.03.13.36.838600@yahoo.com>,
>  Dave Uhring <daveuhring@yahoo.com> wrote:
> 
>> It's *your* home directory :-)
> 
> Yet you're trying to make some general assumptions about when various 
> dot-files get modified!

I did indicate to you that at least one file in your home directory was
last modified at its creation date:

"There is almost certainly at least one file there which has remained
unmodified.  I copied my user home directory from another system to this
one and "ls -lat .??*" clearly shows that my account was created on
Dec 7, 2002."

If that MAC's userland still resembles FreeBSD-3.2, from which it
derives, and you don't have access to a Solaris system then what does

$ ls -lat ~/.??*

show you about the file creation dates?

In comp.sys.sun.admin Dave Uhring <daveuhring@yahoo.com> wrote:
> unlikely to be changed.  Of course the user can change any file in his
> home directory, but some are unlikely to be changed, ~/.dtprofile as an
> example.

..dtprofile is where you might set the BROWSER variable, so it's not 
unlikely that it has been modified. Plus, logins might exist longer
than CDE (I have lots of them) and therefore, .dtprofile.

> OTOH, how many hidden files in *your* home directory were added on the
> date your user account was created and still retain the same date/time?

For me, none. The oldest file has a modification date from 1996 
(.plan), my account is much older. I have user accounts that are
only used remotely - the only file I give them at creation is
..cshrc, which usually gets modified frequently.

Anyway, to answer the OP's question - there's no 100% safe way to 
find out when an account is created, therefore it's recommended to
log account creations/removals in a log file. If you have a script
to add accounts, that's pretty easy anyway.

mp.
-- 
Systems Administrator | Institute for Software Science | Univ. of Vienna

In article <pan.2004.10.28.04.36.22.84387@yahoo.com>,
 Dave Uhring <daveuhring@yahoo.com> wrote:

> On Thu, 28 Oct 2004 00:03:54 -0400, Barry Margolin wrote:
> 
> > In article <pan.2004.10.28.03.13.36.838600@yahoo.com>,
> >  Dave Uhring <daveuhring@yahoo.com> wrote:
> > 
> >> It's *your* home directory :-)
> > 
> > Yet you're trying to make some general assumptions about when various 
> > dot-files get modified!
> 
> I did indicate to you that at least one file in your home directory was
> last modified at its creation date:
> 
> "There is almost certainly at least one file there which has remained
> unmodified.  I copied my user home directory from another system to this
> one and "ls -lat .??*" clearly shows that my account was created on
> Dec 7, 2002."
> 
> If that MAC's userland still resembles FreeBSD-3.2, from which it
> derives, and you don't have access to a Solaris system then what does
> 
> $ ls -lat ~/.??*
> 
> show you about the file creation dates?

I see, I didn't notice the -t option there.  The point you're making is 
that the oldest file probably dates to the time when it was created (you 
could have just said so, instead of being so obtuse).  That's probably 
as good a heuristic as you can get.

-- 
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***