List users and groups on a Linux server

Knowing who has an account on your server is the first step in keeping it secure. A fresh Linux VPS already has dozens of accounts, but almost all of them are system accounts that cannot log in. This guide shows how to list every user and group, how to pick out the human accounts, and how to see who belongs to which group.

Before you start

• A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
• An SSH session. Reading the user list needs no special rights; checking login status with passwd -S needs sudo.

Where user accounts live

Local accounts are stored in three plain text files:

• /etc/passwd: one line per account with its name, user ID (UID), group ID, home folder and shell.
• /etc/shadow: password hashes and expiry data, readable only by root.
• /etc/group: groups and their extra members.

Each line in /etc/passwd has seven fields separated by colons:

deploy:x:1001:1001:Deploy user:/home/deploy:/bin/bash

From left to right: username, a placeholder for the password, UID, primary group ID, comment, home folder and login shell.

List all users

The most reliable command is getent, because it also includes accounts from other sources such as LDAP if your server uses them:

getent passwd

To show names only:

getent passwd | cut -d: -f1

Bash has a shorter built-in that lists usernames too:

compgen -u

Count the accounts with getent passwd | wc -l. Do not be surprised by a number above 20 or 30.

Show only real (human) users

Linux separates accounts by UID range. The ranges are set in /etc/login.defs:

• UID 0 is root.
• UID 1–999 are system accounts, used by services such as www-data, sshd or mysql. On AlmaLinux and Rocky the system range is set by SYS_UID_MAX, normally 999.
• UID 1000 and above are normal users created with adduser or useradd. 65534 is nobody, a special account, not a person.

Check the limits on your server:

grep -E '^UID_(MIN|MAX)' /etc/login.defs

Then list only regular users with awk:

getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1, $3, $6, $7}'

Example output:

deploy 1001 /home/deploy /bin/bash
anna 1002 /home/anna /bin/bash

Also list every account that has a real login shell, because a system account with Bash could be a sign of tampering:

getent passwd | grep -vE '(nologin|false|sync|shutdown|halt)$'

You should normally see root and your own users only.

Check whether an account can log in

A user with a valid shell may still have a locked password. Check with:

sudo passwd -S deploy

The second field shows P for a usable password, L for locked and NP for no password. On AlmaLinux and Rocky the codes are PS, LK and NP, followed by a short note in brackets such as (Password set, SHA512 crypt.).

List groups

List every group on the server:

getent group

Each line shows the group name, a placeholder, the group ID and the extra members:

sudo:x:27:deploy,anna

To see the members of one group, ask for it by name:

getent group sudo
getent group wheel

On Ubuntu and Debian, sudo is the admin group. On AlmaLinux and Rocky it is wheel. Anyone listed there can run commands as root.

List the groups of one user

id deploy

uid=1001(deploy) gid=1001(deploy) groups=1001(deploy),27(sudo)

groups deploy prints the same group names in a shorter form.

Check it works

Create a test account and confirm it appears in the human user list, then remove it:

sudo useradd -m testuser
getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1}'
sudo userdel -r testuser

testuser shows in the list after the first command and is gone after the last.

Troubleshooting

• A user you created is missing from the list: you are probably filtering by UID and the account was made with --system. Run getent passwd <name> to see its real UID.
• passwd -S says "Permission denied": it needs root. Run it with sudo.
• An unknown account with a UID of 0: only root should have UID 0. A second one is a serious warning sign. Check with awk -F: '$3 == 0' /etc/passwd and treat the server as possibly compromised.
• compgen: command not found: you are not in Bash, for example in sh. Type bash first or use getent passwd instead.

Next steps

• Create a new account: Add a new user on Linux.
• Change group membership: Add a user to a group in Linux.
• See who is active right now: See who is logged in (w, who, last).