Updated: 18 October 2026 · Applies to: Ubuntu 26.04 (tested: uutils id 0.10.0, wtmpdb 0.75, lastlog2 2.41.3, finger 0.17), Debian 13 and AlmaLinux 10.2 (tested: shadow-utils 4.15, util-linux 2.40); the same commands work on Ubuntu 24.04, Rocky Linux and RHEL 9 and 10
To get a user ID on Ubuntu or any other Linux system, run id -u alice (or id -u for your own account). id alice adds the main group and all other groups, getent passwd alice prints the full account record, chage -l alice shows password and account expiry, and last alice lists the user's logins. Run them as root (or with sudo) to see everything.
This article is about one account. To list every user on a server, see How to List Users on Unix, Linux, FreeBSD and macOS.
1. Get the user ID (UID) and groups
Lab example from our Ubuntu 26.04 test container:
$ id alice uid=1001(alice) gid=1001(alice) groups=1001(alice) $ id -u alice 1001 $ id -un 1000 ubuntu
id -uprints the UID,id -gthe main group ID,id -Gall group IDs andid -nGthe group names (the same list asgroups alice).id -un 1000goes the other way: from a UID to the user name.- In a shell script,
$UIDholds the UID of the user running it (0 for root).
Why alice got 1001 here: Ubuntu container images already have a default ubuntu user with UID 1000, so the next account gets 1001. On a system without it (our AlmaLinux 10 test), the first user you add gets 1000.
2. Read the full account record
$ getent passwd alice alice:x:1001:1001:Alice Example:/home/alice:/bin/bash $ getent group sudo sudo:x:27:ubuntu,deploy
The passwd line has seven fields separated by colons: name, password placeholder (x means the hash is in /etc/shadow), UID, GID, comment, home folder and login shell. getent also finds users from LDAP or Active Directory, which grep alice /etc/passwd would miss. Administrators are members of sudo on Ubuntu and Debian and of wheel on AlmaLinux, Rocky Linux and RHEL (getent group wheel). To add someone to a group, see How To Add User To A Group In Linux?
passwd -S (as root) shows whether the password is usable:
$ sudo passwd -S alice alice P 2026-10-12 0 99999 7 -1
P means a usable password, L a locked one and NP no password.
3. Service accounts (system users)
A service account is a Linux user that runs a program, such as a web server, a database or your own app, instead of a person. It owns the program's files and processes, so a bug or break-in in that program only gets the access that account has, not root's. You can recognise one by three things: a UID below 1000, a shell such as /usr/sbin/nologin, and a locked password. Create one with:
sudo useradd --system --no-create-home --shell /usr/sbin/nologin myapp
Result on Ubuntu 26.04 (lab example):
$ getent passwd myapp myapp:x:996:996::/home/myapp:/usr/sbin/nologin $ sudo passwd -S myapp myapp L 2026-10-12 -1 -1 -1 -1
--system takes a UID from the system range (AlmaLinux 10 sets SYS_UID_MIN 201 and SYS_UID_MAX 999 in /etc/login.defs; our test account got 998 there) and also creates a matching group. The home path is listed but not created. No one can log in as myapp, but a systemd unit runs the service as that user with User=myapp in its [Service] section. To see all system and service accounts:
awk -F: '$3 < 1000 {print $1}' /etc/passwd
4. List users on Red Hat (RHEL, AlmaLinux, Rocky Linux)
The same tools work on Red Hat systems. To list only the people, filter by UID; for a table with the last login, use lslogins -u. Lab example from AlmaLinux 10.2:
$ awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd
alice
$ sudo lslogins -u
UID USER PROC PWD-LOCK PWD-DENY LAST-LOGIN GECOS
0 root 3 0 0 Super User
1000 alice 0 1 0 Alice Example
lslogins is in util-linux on AlmaLinux, Rocky Linux, RHEL, Debian 13 and Ubuntu 24.04; on Ubuntu 26.04 install util-linux-extra first. lslogins alice prints everything about one account, including the password method, last login, last terminal and host, and running processes. More ways to list users: How to List Users using Linux Command Line?
5. Password and account expiry
$ sudo chage -l alice Last password change : Oct 12, 2026 Password expires : never Password inactive : never Account expires : never Minimum number of days between password change : 0 Maximum number of days between password change : 99999 Number of days of warning before password expires : 7
To set or remove expiry dates, see Linux Password Expiration: Check, Set or Disable with chage.
6. Login history and last login
last alice # this user's logins last -n 20 # the 20 most recent logins of all users lastlog2 # last login of every account (Debian 13, Ubuntu 26.04) lastlog -u alice # last login of one account (Ubuntu 24.04, AlmaLinux, Rocky, RHEL)
Lab example from Ubuntu 26.04 after three SSH logins (the From column shows 127.0.0.1 because the logins came from the same machine; on a server you see the client's IP address):
$ last alice ssh 127.0.0.1 Mon Oct 12 09:43 - 09:43 (00:00) deploy ssh 127.0.0.1 Mon Oct 12 09:43 - 09:43 (00:00) alice ssh 127.0.0.1 Mon Oct 12 09:42 - 09:42 (00:00) wtmpdb begins Mon Oct 12 09:42:50 2026 $ lastlog2 -u alice Username Port From Latest alice ssh 127.0.0.1 Mon Oct 12 09:43:05 +0000 2026
On Debian 13 and Ubuntu 26.04, last is a link to wtmpdb, the old lastlog command is gone and lastlog2 replaces it. In our tests, Debian 13 marks wtmpdb as a standard package and lastlog2 as optional; on Ubuntu 26.04 both are optional. Install them with apt install wtmpdb libpam-wtmpdb lastlog2 libpam-lastlog2; the two PAM modules are what record each new login. On AlmaLinux 10, last and lastb come from util-linux and lastlog from shadow-utils; a user who never logged in shows **Never logged in**.
Failed logins: sudo lastb lists them on AlmaLinux, Rocky Linux and RHEL. Debian 13 and Ubuntu 26.04 have no lastb; read the SSH log instead with journalctl -u ssh (Debian and Ubuntu) or journalctl -u sshd (Red Hat family). A wrong user name looked like this in our test:
Invalid user bob from 127.0.0.1 port 58818
7. finger and its alternatives
The old finger command (version 0.17) is still in the Debian 13 and Ubuntu 26.04 repositories (apt install finger) but not in the AlmaLinux 10 BaseOS and AppStream repositories. Lab example from Ubuntu 26.04:
$ finger alice Login: alice Name: Alice Example Directory: /home/alice Shell: /bin/bash Last login Mon Oct 12 09:43 (UTC) on pts/0 from 127.0.0.1 No mail. No Plan.
Without finger, pinky -l alice (part of coreutils, installed everywhere) prints the name, home folder and shell, and lslogins alice gives the full picture.
8. Who is logged in right now
who # users with a terminal session w # the same, plus what each one is running loginctl list-sessions # sessions known to systemd
w is explained column by column in Linux w Command: See Who Is Logged In and What They Do. To stop an account from logging in, see How to Block or Disable Normal User Logins in Linux?
Official documentation: id manual page, lslogins manual page and useradd manual page.
