This question already has an answer here:

I want to know list of all users founded in my system. I need non-system users.

I know that the file /etc/passwd contains all users

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
messagebus:x:102:104::/var/run/dbus:/bin/false
colord:x:103:108:colord colour management daemon,,,:/var/lib/colord:/bin/false
lightdm:x:104:111:Light Display Manager:/var/lib/lightdm:/bin/false
whoopsie:x:105:114::/nonexistent:/bin/false
avahi-autoipd:x:106:117:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
avahi:x:107:118:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
usbmux:x:108:46:usbmux daemon,,,:/home/usbmux:/bin/false
kernoops:x:109:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false
pulse:x:110:119:PulseAudio daemon,,,:/var/run/pulse:/bin/false
rtkit:x:111:122:RealtimeKit,,,:/proc:/bin/false
saned:x:112:123::/home/saned:/bin/false
speech-dispatcher:x:113:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/sh
hplip:x:114:7:HPLIP system user,,,:/var/run/hplip:/bin/false
user1:x:1000:1000:user1,,,:/home/user1:/bin/bash
user2:x:1001:1001:user2,,,:/home/user2:/bin/bash
user3:x:1002:1002:user3,,,:/home/user3:/bin/bash
user4:x:1003:1003:user4,,,:/home/user4:/bin/bash
xrdp:x:115:126::/var/run/xrdp:/bin/false
lxc-dnsmasq:x:116:128:LXC dnsmasq,,,:/var/lib/lxc:/bin/false
clamav:x:117:129::/var/lib/clamav:/bin/false
dhcpd:x:118:132::/var/run:/bin/false
liquidsoap:x:119:133::/usr/share/liquidsoap:/bin/false
sshd:x:120:65534::/var/run/sshd:/usr/sbin/nologin

But as you can see the file may come to be very big as you install more services and I can't just open and search for non-system users that easily.

So i need a simple command to list those users. Thanks

marked as duplicate by souravc, user117103, Radu Rădeanu, Warren Hill, Eric Carvalho Mar 21 '14 at 14:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

I do not clear solution. But I can help you to find real users.

First solution:

in /etc/passwd, last column showing default shell/command. In Ubuntu it is usually /bin/bash, but it is not a rule. So you can try:

sudo grep '/bin/bash' /etc/passwd | cut -d: -f1

Also usually real users home folder located in /home. You can try:

sudo grep '/home/' /etc/passwd | cut -d: -f1

Or both of them:

sudo grep -E '/home.*/bin/bash' /etc/passwd | cut -d: -f1

Second solution:

There is also a file /etc/shadow, where in second column encrypted users passwords. System programs and daemons do not have passwords, usually. Here you can try:

sudo awk -F: '$2 != "*" && $2 !~ /^!/ { print $1, " - has pwd" }' /etc/shadow

But please understand, all this solution not 'clear'. Sometimes users can create there home folders at other places, they can login without passwords and their default shell/command can be any, such as zsh , sh , ksh etc...

  • I think its a hard solution but +1 for your effort – user259474 Mar 21 '14 at 7:54

Another way to do this would be

getent passwd | tr ":" " " | awk "\$3 >= $(grep UID_MIN /etc/login.defs | cut -d " " -f 2) { print \$1 }" | sort| uniq|sed -e 's/nobody//g'
  • +1 but this repeat the users if they are login. The output shows multiple entries for same user in addition nologin is still shown. – user259474 Mar 21 '14 at 7:57
  • updated the answer.Try now. – Stormvirux Mar 21 '14 at 8:26