Viewing system users in Linux

This article describes how to list the users on a Linux® server.

Display users and user details on Linux

Display a list of the users and user details on a Linux server by using one of the following commands:

getent passwd or less /etc/passwd

These commands display the login name, optional encrypted password, numerical user ID, numerical group ID, user name or comment field, user home directory, and optional user command interpreter. The following is an example of the output:

     root❌0:0:root:/root:/bin/bash
     bin❌1:1:bin:/bin:/sbin/nologin
     daemon❌2:2:daemon:/sbin:/sbin/nologin
     adm❌3:4:adm:/var/adm:/sbin/nologin
     lp❌4:7:lp:/var/spool/lpd:/sbin/nologin
     sync❌5:0:sync:/sbin:/bin/sync
     shutdown❌6:0:shutdown:/sbin:/sbin/shutdown
     halt❌7:0:halt:/sbin:/sbin/halt
     mail❌8:12:mail:/var/spool/mail:/sbin/nologin
     operator❌11:0:operator:/root:/sbin/nologin
     games❌12💯games:/usr/games:/sbin/nologin
     ftp❌14:50:FTP User:/var/ftp:/sbin/nologin
     nobody❌99:99:Nobody:/:/sbin/nologin
     systemd-network❌192:192:systemd Network Management:/:/sbin/nologin
     dbus❌81:81:System message bus:/:/sbin/nologin
     polkitd❌999:998:User for polkitd:/:/sbin/nologin
     libstoragemgmt❌998:997:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
     abrt❌173:173::/etc/abrt:/sbin/nologin
     rpc❌32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
     gluster❌997:995:GlusterFS daemons:/run/gluster:/sbin/nologin
     sshd❌74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
     postfix❌89:89::/var/spool/postfix:/sbin/nologin
     chrony❌996:993::/var/lib/chrony:/sbin/nologin
     ntp❌38:38::/etc/ntp:/sbin/nologin
     tcpdump❌72:72::/:/sbin/nologin
     centos❌1000:1000:Cloud User:/home/centos:/bin/bash
     rack❌1001:1001::/home/rack:/bin/bash
     testuser❌1002:1002::/home/testuser:/bin/bash
     apache❌48:48:Apache:/usr/share/httpd:/sbin/nologin

You can close the output of these commands by entering the q key.

See the users currently logged in by using the following command:

w

This command output looks like the following example:

     15:23:01 up 77 days,  6:51,  1 user,  load average: 0.00, 0.01, 0.05
     USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
     rack     pts/0    dfw.secure-acces 14:54    5.00s  0.26s  0.33s sshd: rack [priv]