How to Monitor System User Account Changes
How to Monitor System User Account Changes
Need to monitor system user account changes on your Linux server? Want to track user account modifications, detect unauthorized account changes, and verify account security? This guide shows you how to monitor user account changes using built-in commands and automated monitoring with Zuzia.app.
For comprehensive user activity monitoring strategies, see User Activity & Login Monitoring. For troubleshooting authentication issues, see User Authentication Failures.
Why Monitoring User Account Changes Matters
User account changes affect system security and access control. When user accounts are modified unexpectedly, unauthorized access can be granted, security settings can be altered, and system security can be compromised. Monitoring user account changes helps you detect unauthorized modifications, track account history, maintain account security, and ensure only authorized account changes occur.
Method 1: Check User Account Status
Check user account status to see current account configuration:
View User Accounts
# List all user accounts
cat /etc/passwd
# View user account details
id username
# Check account lock status
passwd -S username
# View account expiration
chage -l username
Monitor Account Modifications
# View user account creation
sudo grep "useradd\|new user" /var/log/auth.log
# View user account deletion
sudo grep "userdel\|delete user" /var/log/auth.log
# View password changes
sudo grep "password changed\|passwd" /var/log/auth.log
# View group modifications
sudo grep "groupadd\|groupdel\|groupmod" /var/log/auth.log
Method 2: Detect Account Changes
Detect account changes to identify modifications:
Compare Account Files
# Compare current accounts with baseline
diff /etc/passwd /backup/passwd-baseline.txt
# Compare group files
diff /etc/group /backup/group-baseline.txt
# Check for new accounts
comm -13 <(sort /backup/passwd-baseline.txt) <(sort /etc/passwd)
# Check for deleted accounts
comm -23 <(sort /backup/passwd-baseline.txt) <(sort /etc/passwd)
Monitor Account Modifications
# Check account file modification time
stat /etc/passwd | grep Modify
# View recent account changes
find /etc -name "passwd\|group\|shadow" -mtime -1 -ls
# Track account modifications
ls -lt /etc/passwd /etc/group /etc/shadow
Method 3: Verify Account Security
Verify account security to ensure accounts are properly configured:
Check Account Security Settings
# View account password policies
grep -E "PASS_MIN_LEN|PASS_MAX_DAYS|PASS_WARN_AGE" /etc/login.defs
# Check for accounts with no password
awk -F: '($2 == "" ) {print $1}' /etc/shadow
# View accounts with UID 0
awk -F: '$3 == 0 {print $1}' /etc/passwd
# Check account lock status
awk -F: '($2 ~ /^!|^LOCKED/) {print $1}' /etc/shadow
Monitor Account Access
# View recent logins
last | head -20
# Check failed login attempts
lastb | head -20
# View current logged-in users
who
# Monitor account activity
w
Method 4: Automated User Account Change Monitoring with Zuzia.app
Manual checks work while you are looking. To keep running them without you, Zuzia uses its agent and scheduled tasks.
How it works in Zuzia
- Install the Zuzia agent on the server with one command. CPU, RAM, disk, load and network metrics start reporting on their own, with alerts on a threshold, on drift from the server's normal, or on a disk fill-up forecast.
- Save the commands from this guide as a scheduled task and choose how often it runs, from every minute to once a year. The agent runs it on every host you pick.
- If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account).
- The output of every run is kept, so you can look back at what changed. On paid plans, AI can read the output and alert you only when it spots a problem.
Setting it up
- Add the server in the Zuzia dashboard and install the agent.
- Create a scheduled task with the check commands below, then choose the hosts and how often it runs.
- Choose your notification channels. Turn on maintenance mode during planned work so it doesn't trigger alerts.
Custom User Account Monitoring Commands
Add these commands as scheduled tasks:
# Check for account changes
diff /etc/passwd /backup/passwd-baseline.txt
# Verify account security
awk -F: '$3 == 0 {print $1}' /etc/passwd
# Monitor account modifications
grep -E "useradd|userdel|passwd" /var/log/auth.log | tail -10
# Check account file integrity
md5sum /etc/passwd /etc/group /etc/shadow
Best Practices
1. Monitor Account Changes Continuously
Use Zuzia.app for continuous account change monitoring. Set up alerts before account issues become critical. Review account changes regularly.
2. Maintain Account Baselines
Keep accurate account baselines. Store baselines securely. Update baselines when authorized changes occur.
3. Verify Account Security
Monitor account security settings. Check for unauthorized accounts. Verify account access controls. Respond to account security issues quickly.
Troubleshooting
Unauthorized Account Changes Detected
When unauthorized changes are detected:
- Review account changes:
diff /etc/passwd /backup/passwd-baseline.txt - Identify modified accounts
- Verify changes are authorized
- Restore accounts if unauthorized
Account Security Issues
When account security issues occur:
- Check account security:
awk -F: '$3 == 0 {print $1}' /etc/passwd - Review account access:
last | head -20 - Fix account security issues
- Verify account security restored
FAQ
How often should I check user account changes?
For production servers, check account changes every 6-12 hours. Zuzia.app can check accounts automatically and alert when account changes are detected.
What account changes should I monitor?
Monitor account creation, deletion, password changes, group modifications, and account security settings. Focus on changes that affect system security.
Can Zuzia.app detect unauthorized account changes automatically?
Yes, Zuzia.app can detect unauthorized changes by comparing account files with baselines, monitoring account modifications, tracking account security, and alerting when unauthorized changes are detected.
Related guides, recipes, and problems
Related guides
Related recipes
Related problems