Monitor User Details (UID and Shell)

Updated: 2025-11-17

How to Monitor User Details (UID and Shell) on Linux Server

Set up continuous monitoring to check user account details including UID and shell on your Linux server? Need to monitor user accounts and detect unauthorize...

Why Monitoring User Details Matters

User account details including UID (User ID) and shell configuration are critical for security and access control. Unauthorized changes to user accounts, such as UID modifications or shell changes, can indicate security breaches or privilege escalation attempts. Regular monitoring of user details helps you detect unauthorized user creation, audit user configurations, maintain security compliance, and track user access changes to ensure your Linux server remains secure.

Method 1: Check User Details with awk Command

The awk command is powerful for parsing /etc/passwd and extracting user details including UID and shell.

Basic User Details Check

To see user details with UID and shell:

# User details with UID and shell
awk -F: '{print $1, $3, $7}' /etc/passwd | sort -t: -k2,2n

This command:

Parses /etc/passwd using : as delimiter (-F:)
Prints username ($1), UID ($3), and shell ($7)
Sorts by UID numerically

List All Users

To see just usernames:

# List all users
cut -d: -f1 /etc/passwd

This extracts only usernames from /etc/passwd.

User Details Sorted by UID

To see users sorted by UID:

# User details sorted by UID
awk -F: '{print $1, $3, $7}' /etc/passwd | sort -nk2

This helps identify UID ranges and detect unusual UID assignments.

Users with Specific Shell

To find users with a specific shell:

# Users with bash shell
awk -F: '$7=="/bin/bash" {print $1}' /etc/passwd

# Users with nologin shell
awk -F: '$7=="/usr/sbin/nologin" {print $1}' /etc/passwd

# Users with sh shell
awk -F: '$7=="/bin/sh" {print $1}' /etc/passwd

This helps identify which users have interactive shells vs. system accounts.

Method 2: Check User Details with getent Command

The getent command provides a more portable way to query user databases.

Get User Details

# Get user details for specific user
getent passwd username

# Get all users
getent passwd

This works with various user database backends (local files, LDAP, etc.).

Parse User Details

# Extract UID and shell for all users
getent passwd | awk -F: '{print $1, $3, $7}'

This provides the same information as parsing /etc/passwd directly.

Method 3: Check User Details with id Command

The id command shows detailed information about a specific user.

Check Specific User Details

# Check user details
id username

# Check UID, GID, and groups
id -u username  # UID only
id -g username  # Primary GID only
id -G username   # All GIDs

This provides comprehensive user information including UID, GID, and group memberships.

Method 4: Automated User Details Monitoring with Zuzia.app

Running these checks by hand works once. Zuzia's agent lets you repeat them on every server without logging in to each one.

How it works in Zuzia

Install the Zuzia agent on the server with one command.
Zuzia runs a basic security audit on the host and lists what it found. On paid plans, AI summarises the findings in plain language.
The agent collects system logs, so you can read them in the panel instead of over SSH.
Save the commands from this guide as a scheduled task and choose how often they run. If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account). On paid plans, AI can read the output and alert you only when it spots a problem.

Setting it up

Add the server in the Zuzia dashboard and install the agent.
Open the host's security audit and logs.
Create a scheduled task with the check commands below, choose the hosts and frequency, and pick your notification channels.

Method 5: Advanced User Monitoring Techniques

Compare User Lists Over Time

By storing user lists in Zuzia.app, you can compare current users with previous lists to detect new users or changes.

Monitor Specific Users

To monitor specific users:

# Check specific user details
getent passwd username | awk -F: '{print "User:", $1, "UID:", $3, "Shell:", $7}'

# Monitor multiple users
for user in user1 user2 user3; do
  getent passwd $user | awk -F: '{print $1, $3, $7}'
done

This helps track changes to specific user accounts.

Detect Privilege Escalations

Monitor for UID changes that might indicate privilege escalation:

# Check for UID 0 users (should only be root)
awk -F: '$3==0 {print $1}' /etc/passwd

# Check for low UID users (system accounts)
awk -F: '$3<1000 && $3!=0 {print $1, $3}' /etc/passwd

This helps detect unauthorized privilege escalations.

Real-World Use Cases for User Details Monitoring

Security Compliance Auditing

For compliance requirements, verify user account configurations:

# Audit user details
awk -F: '{print $1, $3, $7}' /etc/passwd > /tmp/users-audit-$(date +%Y%m%d).txt

# Document findings
echo "User audit completed: $(date)" >> /tmp/users-audit-$(date +%Y%m%d).txt

Store audit results in Zuzia.app for compliance documentation.

Unauthorized User Detection

Detect unauthorized user creation:

# Compare current users with baseline
awk -F: '{print $1}' /etc/passwd | sort > /tmp/current-users.txt
diff /tmp/baseline-users.txt /tmp/current-users.txt

Set up Zuzia.app to check user details daily and alert when new users are detected.

Access Control Verification

Verify user access configurations:

# Check users with interactive shells
awk -F: '$7!~/(nologin|false)$/ {print $1, $7}' /etc/passwd

# Check users with no shell (should be system accounts)
awk -F: '$7=="" {print $1}' /etc/passwd

Ensure only authorized users have interactive shells.

Best Practices for User Details Monitoring

1. Monitor User Details Regularly

Check user details at least once daily or weekly. User account changes are typically infrequent but important to detect quickly. Use Zuzia.app automated monitoring to ensure regular checks.

2. Track User Account Changes

Use Zuzia.app's historical data to track user account changes over time. Understanding when users are created or modified helps detect unauthorized access.

3. Monitor UID Assignments

Monitor UID assignments to detect privilege escalations. Low UIDs (0-999) are typically reserved for system accounts, while regular users should have UIDs >= 1000.

4. Verify Shell Configurations

Verify shell configurations to ensure users have appropriate access. System accounts should have /usr/sbin/nologin or /bin/false, while regular users should have interactive shells like /bin/bash.

5. Review Audit Results Promptly

Review user monitoring results promptly and investigate any unauthorized changes immediately. Unauthorized user creation or UID changes are serious security risks.

Troubleshooting Common User Monitoring Issues

User Details Not Showing

If user details are not showing:

Verify /etc/passwd is readable: ls -la /etc/passwd
Check command syntax: Ensure awk command is correct
Verify user exists: getent passwd username
Check for LDAP/NIS: If using centralized authentication, use getent instead of parsing /etc/passwd

Unexpected User Changes

If unexpected user changes are detected:

Verify the change is authorized
Check system logs: grep username /var/log/auth.log
Review recent system changes
Investigate potential security breach

Shell Configuration Issues

If shell configurations are incorrect:

Verify shell exists: ls -la /bin/bash /usr/sbin/nologin
Check user's actual shell: getent passwd username | cut -d: -f7
Update shell if needed: chsh -s /bin/bash username

FAQ: Common Questions About Monitoring User Details

How often should I check user details on Linux?

We recommend checking user details once daily or weekly. User account changes are typically infrequent but important to detect quickly. Use Zuzia.app automated monitoring to check user details continuously without manual intervention.

What should I do if user details change unexpectedly?

If user details change unexpectedly, immediately investigate: verify the change is authorized, check system logs for account modifications, review recent system changes, and investigate potential security breaches. Use Zuzia.app to track when changes occurred and compare with authorized change logs.

Can I monitor specific users or UID ranges?

Yes, you can modify commands to filter specific users or UID ranges: awk -F: '$3>=1000 && $3<2000 {print $1, $3, $7}' /etc/passwd for UID range 1000-1999, or getent passwd username for specific users. This helps focus monitoring on relevant user accounts.

How can I see user account changes over time?

Zuzia.app stores all user details data historically in its database, allowing you to view user account changes over time. You can see historical data showing which users existed on different dates, identify when users were created or modified, and track changes to UID or shell configurations.

What's the difference between UID and username?

UID (User ID) is a numeric identifier assigned to each user account, while username is the human-readable account name. UID is used internally by the system, while username is used for login and identification. Monitoring both helps detect account changes and privilege escalations.

Can I monitor user groups along with user details?

Yes, you can extend monitoring to check user groups: groups username shows groups for a specific user, id username shows UID, GID, and groups, or getent group shows all groups. This provides comprehensive user access information.

Does Zuzia.app use AI to analyze user account patterns?

On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.