The /etc/passwd
file has no date information, so it is unhelpful here.
All non-system users should have a /home/%username%
directory. You might try visiting all directories under /home
(using a shell loop), and reporting the oldest file or directory in each one. Like:
$ for dir in /home/*; do
ls -lart --time-style=long-iso "${dir}" |
grep '^-' | head -n 1 |
awk '{ printf ("%-10s %s\n", $3, $6); }'
done
ls: cannot open directory '/home/lost+found': Permission denied
paul 2017-03-16
1001 2021-03-02
If you are fairly lucky, and nobody has back-dated a file with touch
, that should show you the user's name (or their numeric uid if they have been removed), and the date of the oldest file in their home directory.
Generally, it is unhealthy to parse the output from ls
, but the fields you need for this are fairly predictable.
The order of my output looks odd, because I have a directory /home/viewer (which determines the order of the shell expansion), but user viewer has been removed, and was uid 1001.
I am not sure why you had to scroll through the list to find the user, or why sorting by date would make that easier. You could redirect the output to a file and search with an editor, or grep for the username, or sort the output by the second column.
If you add a user, the traditional method to prove that it worked is to log in as that user, change any default password, fix up any local requirements (like a standard prompt or aliases), check that a few simple commands work, and then ensure the new user sets their own password on their first login.