DE

↑ ↓ select, Enter open, Esc close

List user accounts with a login shell

harmlessSecurityalle
user@server
awk -F: '$7 !~ /(nologin|false)$/ {print $1, $3, $6, $7}' /etc/passwd

Parses /etc/passwd and prints the username, UID, home directory and shell of every account that has a real login shell. Expected are root and your own admin accounts. On Plesk, system users of subscriptions that were granted SSH access also appear.

Note: An unknown account with /bin/bash is a warning sign. Accounts that come from LDAP or similar sources are not listed in this file.

Also searched as

  • list users who can log in linux
  • show users with bash shell
  • find accounts with shell access

Related one-liners

All in Security

Find accounts with UID 0 and root privileges

$awk -F: '$3 == 0 {print $1}' /etc/passwd
harmlessSecurity

Show the password status of all user accounts

#passwd -S -a
harmlessSecurity

Find world-writable files and directories

$find /var/www/vhosts -xdev -perm -0002 ! -type l -ls 2>/dev/null
harmlessSecurity

List all SSH keys authorized on the server

#find / -xdev -path '*/.ssh/authorized_keys' -type f -exec awk 'NF && !/^#/ {print FILENAME ": " $NF}' {} + 2>/dev/null
harmlessSecurity

List the members of the sudo group

$getent group sudo
harmlessSecurity

Show commands run with sudo from the journal

#journalctl _COMM=sudo --since "7 days ago" --no-pager | grep 'COMMAND='
harmlessSecurity

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.