How to List Users in Linux

If you need to check who can log in, verify service accounts, or confirm that a user exists, you need a reliable way to list Linux users from local and directory sources. Every user account on a Linux system is recorded in the /etc/passwd file or in a network directory service such as LDAP.

The quickest way to list every account is getent passwd, which reads local files and any directory service such as LDAP or SSSD. To see only real human accounts, filter the output by UID (typically 1000 and above), or run lslogins, which applies that split for you. For currently logged-in users, run who or w.

This guide explains how to list users in Linux using /etc/passwd, getent, lslogins, and several related commands for everyday user management.

List All Users with /etc/passwd #

Local user information is stored in the /etc/passwd file. Each line represents one user account. To view the file, use cat or less :

less /etc/passwd

Each line contains seven colon-delimited fields:

To print only the usernames, use awk or cut :

awk -F: '{ print $1 }' /etc/passwd

cut -d: -f1 /etc/passwd

root
daemon
bin
sys
sync
...
sshd
vagrant
jack
anne

List All Users with getent #

The getent command queries name service databases configured in /etc/nsswitch.conf, including the passwd database. Unlike reading /etc/passwd directly, getent also returns users from LDAP, NIS, or SSSD if your system uses a network directory.

To list all users:

getent passwd

The output format is the same as /etc/passwd. To extract only the usernames:

getent passwd | cut -d: -f1

List Users with lslogins #

The lslogins command comes from the util-linux package, so it is present on practically every modern distribution without installing anything. Unlike the previous two methods, it prints a formatted table and already knows the difference between system and human accounts, which saves you from writing an awk filter.

Run it without arguments to list every account:

lslogins

  UID USER      PROC PWD-LOCK PWD-DENY LAST-LOGIN GECOS
    0 root       147                 0 Aug13/09:41 root
    1 bin          0                 1             bin
    2 daemon       0                 1             daemon
 1000 vagrant      4                 0 Aug14/08:02 vagrant,,,
 1001 jack         0                 0 Aug12/17:20 ,,,
 1002 anne         0                 0             Anne Stone

The PROC column counts the processes each account is currently running, PWD-DENY marks accounts that cannot log in with a password, and LAST-LOGIN is empty for accounts that have never signed in. In the output above, anne has an account but has never logged in.

To restrict the list to regular user accounts, use the -u option:

lslogins -u

This shows accounts with a UID of 1000 and above, plus root. The counterpart is -s, which shows system accounts (UID 101 to 999 by default). Those ranges are only defaults: if UID_MIN, UID_MAX, SYS_UID_MIN, or SYS_UID_MAX are set in /etc/login.defs, lslogins uses your values instead.

To look up a single account, pass the username to -l:

lslogins -l jack

The -a option adds the last password change and account expiry dates, -G adds supplementary group membership, and --output-all prints every available column. To see which columns you can select with -o, run lslogins --list-columns.

Check Whether a User Exists #

To check if a specific user account exists, pass the username directly to getent:

getent passwd jack

If the user exists, the command prints the full /etc/passwd entry for that account. If the user does not exist, there is no output and the exit code is 2.

You can use this in a script to test for a user:

if getent passwd jack > /dev/null 2>&1; then
    echo "User jack exists"
fi

To count the total number of user accounts on the system:

getent passwd | wc -l

List Only Human Users #

Linux distinguishes between system accounts (created during installation or by packages) and human accounts (created by administrators). The difference is the UID range. On most distributions, human users have a UID between 1000 and 60000, as defined in /etc/login.defs. That starting point is a convention rather than a rule: Debian, Ubuntu, and RHEL 9 and later begin regular users at 1000, but older Red Hat systems began at 500, so confirm the range before hard-coding a number into a script.

To check the UID range on your system:

grep -E '^UID_MIN|^UID_MAX' /etc/login.defs

UID_MIN          1000
UID_MAX         60000

To list only human user accounts:

getent passwd | awk -F: '$3 >= 1000 && $3 <= 60000'

vagrant:x:1000:1000:vagrant,,,:/home/vagrant:/bin/bash
jack:x:1001:1001:,,,:/home/jack:/bin/bash
anne:x:1002:1002:Anne Stone,,,:/home/anne:/bin/bash
patrick:x:1003:1003:Patrick Star,,,:/home/patrick:/usr/sbin/nologin

To print only the usernames:

getent passwd | awk -F: '$3 >= 1000 && $3 <= 60000 { print $1 }'

Reach for the awk filter when you want plain text you can pipe into another command, or when you need a range other than the one your system defines. If a formatted table is good enough, lslogins -u gives you the same split without the filter.

List Users Who Can Log In #

Some accounts have their shell set to a non-interactive value such as /bin/false to prevent login. The nologin shell lives at /usr/sbin/nologin on Debian and Ubuntu and at /sbin/nologin on RHEL, Fedora, and their derivatives, so match on the shell name rather than the full path:

getent passwd | awk -F: '$7 !~ /(nologin|false)$/ { print $1 }'

This filters out service accounts and shows only users who can actually open a shell session. Keep in mind that a valid shell is not the whole story: an account can still be locked, which lslogins reports in its PWD-LOCK and PWD-DENY columns.

List Logged-In Users #

To see which users are currently logged in, use the who command:

who

jack     pts/0        2026-02-13 09:15 (10.0.2.15)
anne     pts/1        2026-02-13 10:30 (10.0.2.20)

The w command provides more detail, including what each user is running:

w

For a simple list of logged-in usernames without duplicates:

users

List Users in a Group #

To see which users belong to a specific group, use getent group followed by the group name:

getent group sudo

sudo:x:27:jack,anne

The last field shows the group members. To list all groups a specific user belongs to, use the groups command:

groups jack

jack : jack sudo docker

Last Login Information #

This is the part of user listing that changed the most recently, so the right command depends on how new your system is. The classic lastlog and last commands read /var/log/lastlog and /var/log/wtmp, and neither file format can store timestamps past 2038. Rather than change the formats, the projects behind them dropped the tools:

• Debian 13 (Trixie) removed last and lastb from util-linux, and removed lastlog from the login package.
• Ubuntu removed lastlog in 24.10 and also ships without last and lastb. Ubuntu 24.04 LTS still has all three.
• Fedora 43 replaced lastlog with lastlog2 and keeps a symbolic link for compatibility.

The portable answer is lslogins, because it ships with util-linux on every distribution and reports last-login data on old and new systems alike:

lslogins -L

To see the last login for a single account:

lslogins -L -l jack

Accounts that have never logged in show an empty LAST-LOGIN field, so you do not need the grep -v "Never" trick that older lastlog guides recommend.

On Debian and Ubuntu, install the lastlog2 and libpam-lastlog2 packages so that new logins are actually recorded. Fedora 43 needs no installation, because util-linux provides lastlog2 there. Either way, run:

lastlog2

Its options mirror the old tool. Use -u for one account, -b to show records older than a number of days, and -t to show only records more recent than that:

lastlog2 -u jack

The replacement for last is wtmpdb, which stores sessions in a SQLite database at /var/log/wtmp.db. Install the wtmpdb and libpam-wtmpdb packages, then run:

wtmpdb last

On Ubuntu 24.04 LTS and other systems that still ship the original tools, lastlog and last -n 10 continue to work as before. For a fuller treatment of session history, see the last command .

Quick Reference #

Troubleshooting #

getent command not found
The getent tool is part of glibc utilities and is available by default on most Linux distributions. If it is missing, install the standard libc utilities package for your distribution.

getent passwd does not show LDAP or directory users
Check /etc/nsswitch.conf and verify that passwd includes the correct source (for example files sss or files ldap). If you use SSSD, confirm the service is running and connected.

UID range does not match my distribution
The common human-user range is 1000-60000, but your system can use a different range. Check UID_MIN and UID_MAX in /etc/login.defs, then adjust the awk filter accordingly.

No users appear as logged in
The who, w, and users commands show active sessions only. On servers without interactive logins at that moment, empty output is expected.

lastlog: command not found
Debian 13, Ubuntu 24.10 and later, and Fedora 43 and later removed lastlog because its log format is not safe past 2038. Use lslogins -L, or install the lastlog2 package and run lastlog2.

last: command not found
The same change removed last and lastb from util-linux on Debian 13 and current Ubuntu releases. Install the wtmpdb and libpam-wtmpdb packages so that PAM records new sessions, then run wtmpdb last instead.

lastlog2 shows no logins after installing it
The lastlog2 binary only reads the database; something has to write to it. Install libpam-lastlog2 (or pam_lastlog2 on Fedora) so PAM records new sessions, then log in again. To carry over history from an old system, import the previous file with lastlog2 -i /var/log/lastlog.

FAQ #

What is the difference between system and human users?
System users are created during OS installation or by packages and typically have a UID below 1000. Human users are created by administrators and have UIDs in the 1000-60000 range. System accounts usually have a nologin shell, found at /usr/sbin/nologin on Debian and Ubuntu and at /sbin/nologin on RHEL and Fedora.

Why does my system show so many user accounts?
Most of those are system accounts created by installed packages. Services like sshd, www-data, and nobody each have their own user for security isolation. To see only human accounts, filter by UID range with getent passwd | awk -F: '$3 >= 1000 && $3 <= 60000'.

What is the difference between /etc/passwd and getent?
Reading /etc/passwd shows only local accounts. The getent command queries all configured name services, including LDAP, NIS, and SSSD, so it returns both local and network directory users.

How do I list users in a specific group?
Run getent group groupname. The last field in the output lists the group members. You can also run groups username to see all groups a particular user belongs to.

How do I find out when a user last logged in?
Run lslogins -L for every account, or lslogins -L -l username for one. This works on every current distribution. On Debian 13, Ubuntu 24.10 and later, and Fedora 43 and later, the lastlog and last commands were removed, and their replacements are lastlog2 and wtmpdb last.

How do I list users on Ubuntu or Debian specifically?
The commands are the same as on any other distribution: getent passwd for everything, lslogins -u for regular accounts. The two things that differ from RHEL and Fedora are the nologin shell path (/usr/sbin/nologin rather than /sbin/nologin) and, on Debian 13 and Ubuntu 24.10 and later, the missing lastlog and last commands.

Conclusion #

Linux provides several commands for listing and filtering user accounts. Use getent passwd for a complete list, lslogins -u when you want human accounts without writing a filter, and who or lslogins -L to track login activity.

For managing users, see useradd , userdel , and usermod . To list groups instead of users, see How to List Groups in Linux .

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page