Listing Accounts
OS
Operating System (OS) user accounts are stored in /etc/passwd
. You can get a list of all OS accounts using the following command:
cut -d: -f1 /etc/passwd
If you want a list of user accounts (not service accounts), then you can filter /etc/passwd
for accounts with a UID greater than 999 like this:
cat /etc/passwd | awk -F: '$3 > 999 {print ;}' | cut -d: -f1
SOC
You can get a list of users in Security Onion Console (SOC) by navigating to the Administration interface and then clicking Users
:
To see detail on an individual user account, click the button on the left side of the row to expand the user account:
For more information about the Users page, please see the Administration section.