Skip to main content
Unix & Linux

Return to Answer

added 82 characters in body
Source Link
terdon ♦
terdon ♦
  • 252.3k
  • 69
  • 480
  • 718

I know you said you don't want to go through the output of ps, but what if you could automate it?

$ join <(ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u)  \
       <(getent passwd | grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort)
root
terdon

That might look a little complicated, but here's a breakdown:

ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u : this runs ps showing the processes of all users, passes the output through tail -n+2 which will print all lines after the 1st so we filter out the ps header, then uses cut to print out the user name and the list of user names is passed through sort -u to get a sorted, deduplicated list.

getent passwd | grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort: here, we select all lines in /etc/shells that start with a slash (this should give us the list of valid login shells), and use that as input for a grep which searches the output of getent passwod (whcih should include LDAP users) for known users with that shell. The result of the above should be a list of users with real shells (as opposed to /usr/bin/nologin or /bin/false etc.).

Finally, the output of both of the commands is given as input to join which results in only printing those users who are both in the output of ps and in the list of users with valid login shells.

If this works for you, you can make it into an alias by adding this to your shell's initialization file (~/.bashrc if you're running bash):

alias getUsers="join <(ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u) <(getent passwd | grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort)"

This is not perfect, it might still find some system users. For example, on my system I have git with:

$ getent passwd | grep git /etc/passwd
git:x:996:996:git daemon user:/:/bin/bash

I don't really know when that user would be shown as logged in though. Presumably when running some git commands? In any case, while far from perfect this might serve at least as a temporary workaround.

I know you said you don't want to go through the output of ps, but what if you could automate it?

$ join <(ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u) \
       <(grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort)
root
terdon

That might look a little complicated, but here's a breakdown:

ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u : this runs ps showing the processes of all users, passes the output through tail -n+2 which will print all lines after the 1st so we filter out the ps header, then uses cut to print out the user name and the list of user names is passed through sort -u to get a sorted, deduplicated list.

grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort: here, we select all lines in /etc/shells that start with a slash (this should give us the list of valid login shells), and use that as input for a grep which searches for known users with that shell. The result of the above should be a list of users with real shells (as opposed to /usr/bin/nologin or /bin/false etc.).

Finally, the output of both of the commands is given as input to join which results in only printing those users who are both in the output of ps and in the list of users with valid login shells.

If this works for you, you can make it into an alias by adding this to your shell's initialization file (~/.bashrc if you're running bash):

alias getUsers="join <(ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u) <(grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort)"

This is not perfect, it might still find some system users. For example, on my system I have git with:

$ grep git /etc/passwd
git:x:996:996:git daemon user:/:/bin/bash

I don't really know when that user would be shown as logged in though. Presumably when running some git commands? In any case, while far from perfect this might serve at least as a temporary workaround.

I know you said you don't want to go through the output of ps, but what if you could automate it?

$ join <(ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u)  \
       <(getent passwd | grep -f <(grep '^/' /etc/shells) | cut -d: -f1 | sort)
root
terdon

That might look a little complicated, but here's a breakdown:

ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u : this runs ps showing the processes of all users, passes the output through tail -n+2 which will print all lines after the 1st so we filter out the ps header, then uses cut to print out the user name and the list of user names is passed through sort -u to get a sorted, deduplicated list.

getent passwd | grep -f <(grep '^/' /etc/shells) | cut -d: -f1 | sort: here, we select all lines in /etc/shells that start with a slash (this should give us the list of valid login shells), and use that as input for a grep which searches the output of getent passwod (whcih should include LDAP users) for known users with that shell. The result of the above should be a list of users with real shells (as opposed to /usr/bin/nologin or /bin/false etc.).

Finally, the output of both of the commands is given as input to join which results in only printing those users who are both in the output of ps and in the list of users with valid login shells.

If this works for you, you can make it into an alias by adding this to your shell's initialization file (~/.bashrc if you're running bash):

alias getUsers="join <(ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u) <(getent passwd | grep -f <(grep '^/' /etc/shells) | cut -d: -f1 | sort)"

This is not perfect, it might still find some system users. For example, on my system I have git with:

$ getent passwd | grep git
git:x:996:996:git daemon user:/:/bin/bash

I don't really know when that user would be shown as logged in though. Presumably when running some git commands? In any case, while far from perfect this might serve at least as a temporary workaround.

Source Link
terdon ♦
terdon ♦
  • 252.3k
  • 69
  • 480
  • 718

I know you said you don't want to go through the output of ps, but what if you could automate it?

$ join <(ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u) \
       <(grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort)
root
terdon

That might look a little complicated, but here's a breakdown:

ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u : this runs ps showing the processes of all users, passes the output through tail -n+2 which will print all lines after the 1st so we filter out the ps header, then uses cut to print out the user name and the list of user names is passed through sort -u to get a sorted, deduplicated list.

grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort: here, we select all lines in /etc/shells that start with a slash (this should give us the list of valid login shells), and use that as input for a grep which searches for known users with that shell. The result of the above should be a list of users with real shells (as opposed to /usr/bin/nologin or /bin/false etc.).

Finally, the output of both of the commands is given as input to join which results in only printing those users who are both in the output of ps and in the list of users with valid login shells.

If this works for you, you can make it into an alias by adding this to your shell's initialization file (~/.bashrc if you're running bash):

alias getUsers="join <(ps -aux | tail -n+2 | cut -d' ' -f1 | sort -u) <(grep -f <(grep '^/' /etc/shells) /etc/passwd | cut -d: -f1 | sort)"

This is not perfect, it might still find some system users. For example, on my system I have git with:

$ grep git /etc/passwd
git:x:996:996:git daemon user:/:/bin/bash

I don't really know when that user would be shown as logged in though. Presumably when running some git commands? In any case, while far from perfect this might serve at least as a temporary workaround.