How to List and Find Users in Linux
Linux has no list users command. Local accounts live in /etc/passwd, accounts from LDAP, FreeIPA or Active Directory come through SSSD or similar, and logged-in sessions are tracked separately. Which command you need depends on which of these you are asking about.
All accounts
getent passwd
Each line has seven colon-separated fields:
alice:x:1001:1001:Alice Example:/home/alice:/bin/bash
name:password:UID:GID:comment:home:shell
The x means the password hash is in /etc/shadow, readable only by root.
getent passwd is better than cat /etc/passwd because it asks the system's name service (NSS) and includes accounts from LDAP or SSSD, not just local ones. One caveat: SSSD does not enumerate domain users by default, so a directory with thousands of users will not show up in a full listing. Looking up a single user by name still works.
Names only:
getent passwd | cut -d: -f1
compgen -u # bash builtin, same result
Only human users
Most entries are system accounts for services (www-data, sshd, systemd-network). Regular users get UIDs from UID_MIN in /etc/login.defs, which is 1000 on current distros. UID 65534 is nobody.
getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1}'
lslogins from util-linux does the same with a nicer table and reads UID_MIN itself:
lslogins -u # user accounts, with last login and password status
lslogins -s # system accounts
lslogins alice # everything about one user
To list accounts that can actually log in, filter out nologin and false shells:
getent passwd | grep -Ev '(/nologin|/false)$' | cut -d: -f1,7
A shell of /usr/sbin/nologin does not lock the account completely. It blocks interactive logins, but depending on configuration the user may still be able to use SFTP or SSH port forwarding.
Check whether a user exists
id alice
getent passwd alice
id prints UID, primary group and all groups, or "no such user". Both commands return a non-zero exit code when the user does not exist, which is what you want in scripts:
if id alice &>/dev/null; then
echo "alice exists"
else
sudo useradd -m -s /bin/bash alice
fi
Avoid grep alice /etc/passwd for this check: it matches malice, and misses directory users.
To find a user by UID: getent passwd 1001.
Groups and admin rights
id -nG alice # all groups of a user
getent group sudo # members of sudo (Debian/Ubuntu)
getent group wheel # members of wheel (RHEL family)
getent group | cut -d: -f1
getent group sudo lists only users added to the group as a supplementary group. A user whose primary group is that group does not appear in the member list, so for an admin audit also check /etc/sudoers and /etc/sudoers.d/, or ask sudo directly with sudo -l -U alice.
Who is logged in now
whoami # your own user
who # logged-in sessions, terminal and source IP
w # same, plus idle time and current command
users # just the names
loginctl list-sessions # systemd view, includes desktop and SSH sessions
To see who is running what:
ps -eo user,pid,etime,cmd --sort=user
ps -u alice
Last logins
last # login history from /var/log/wtmp
last alice
lastb # failed logins (root only)
lslogins -u # LAST-LOGIN column per user
last, lastb and lastlog read file formats that break in 2038, so some distros are dropping them. On Debian 13, util-linux no longer provides last and lastb, and lastlog is gone. Install wtmpdb (with libpam-wtmpdb) and use wtmpdb last, or lastlog2 for per-user last logins. lslogins works either way. For SSH logins specifically, the journal is the most reliable record:
journalctl -u ssh --since today | grep Accepted # -u sshd on RHEL family
Account and password status
sudo passwd -S alice # P = password set, L = locked, NP = no password
sudo chage -l alice # password age and account expiry
Quick reference
getent passwd | cut -d: -f1 # all users
getent passwd | awk -F: '$3>=1000 && $3<65534 {print $1}' # human users
lslogins -u # human users, detailed
id alice # does alice exist, which groups
getent group sudo # who is in sudo
who; w # who is logged in
last # login history
sudo chage -l alice # password expiry