There is two types of accounts, system and regular user. System accounts belong to services and daemons, such as lightdm
, dnsmasq
, etc.Typically you cannot login into those accounts (although there are ways).
Regular users, such as your account or other people accounts, can login and interact with the OS through shell (could be bash
, ksh
, mksh
, csh
, or graphical shell such as Gnome
or Unity
).
System accounts range from 100 to 999 by default. There exists one special case, nobody
, who has ID of 65534 (That's the max UID number ). On my system for instance dnsmasq
it runs dnsmasq
service.
Regular user accounts have UID range from 1000 to 65533. Those users can login, unless their password is disabled or their entry in /etc/passwd
has shell set to /usr/sbin/nologin
, or prevented in some other way. These users can have root privilege if they belong to sudo
group.
So if you want to find users who have sudo
privilege you need to parse /etc/group
file. Here's mine:
$ awk '/sudo/' /etc/group
sudo:x:27:xieerqi,testuser
To get just the users, use :
as separator and print 4th field.
$ awk -F':' '/sudo/{print $4}' /etc/group
xieerqi,testuser
In python this is done as so:
>>> with open("/etc/group") as file:
... for lines in file:
... if lines.__contains__("sudo"):
... print lines.split(":")[3]
Here's even more interesting approach. How about if we want to take all the sudo
users and see if they have a shell set up in /etc/passwd
?
$ awk -F':' '/sudo/{gsub(/\,/,"\n");print $4 }' /etc/group | xargs -I {} grep '^{}\:.*' /etc/passwd
xieerqi:x:1000:1000:xieerqi,,,:/home/xieerqi:/bin/mksh
testuser:x:1001:1001:,,,:/home/testuser:/bin/bash