How to List Users in Linux (getent, passwd, who, id)

You need a list of accounts on a box—every local name, human logins only, who is connected right now, or whether deploy already exists before you create it. Linux stores that data in /etc/passwd and exposes it through NSS tools such as getent, id, and who.

The commands below are the ones I reach for on Ubuntu and RHEL hosts. For group membership and listing members of sudo or docker, see list groups in Linux; for creating accounts, see create a user in Linux.

Quick reference

List all users on the system

Use getent (preferred)

getent passwd asks NSS for every passwd entry—local /etc/passwd, systemd dynamic users, SSSD, LDAP, and anything else listed under passwd: in /etc/nsswitch.conf.

getent passwd

Sample output (trimmed):

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
golinuxcloud:x:1000:1000:golinuxcloud:/home/golinuxcloud:/bin/bash
sshd:x:109:65534:sshd:/run/sshd:/usr/sbin/nologin

Each line is username:password_placeholder:UID:GID:gecos:home:shell. The x means hashed passwords live in /etc/shadow, not in this file.

Count how many passwd entries NSS returns:

getent passwd | wc -l

52

Read /etc/passwd (local only)

cat /etc/passwd shows the local file. It is fine on a standalone laptop; on LDAP- or SSSD-backed hosts it can miss directory users that getent still finds.

cut -d: -f1 /etc/passwd

Last few lines on this host:

golinuxcloud
vboxadd
sshd
pipewire
tomcat

Same usernames with awk:

awk -F: '{print $1}' /etc/passwd

List users with compgen

compgen -u is a Bash builtin that lists usernames the shell knows about. It is handy for scripts but not a substitute for getent on NSS-heavy systems.

compgen -u | tail -5

golinuxcloud
vboxadd
sshd
pipewire
tomcat

Normal users vs system accounts

System accounts (UID usually below 1000) run services—daemon, sshd, www-data. Normal users are human or application accounts you create for login; on Ubuntu the minimum UID is defined in /etc/login.defs:

grep '^UID_MIN' /etc/login.defs

UID_MIN			 1000

List human-style accounts (excludes the nobody range at UID 65534):

awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd

golinuxcloud

Use UID_MIN from /etc/login.defs

Instead of hardcoding 1000, read the system threshold:

uid_min=$(awk '/^UID_MIN/ {print $2}' /etc/login.defs)

awk -F: -v min="$uid_min" '$3 >= min && $3 < 65534 {print $1}' /etc/passwd

golinuxcloud

This picks up local policy when UID_MIN is not 1000. List system accounts below that threshold:

uid_min=$(awk '/^UID_MIN/ {print $2}' /etc/login.defs)
awk -F: -v min="$uid_min" '$3 < min {print $1}' /etc/passwd

root
daemon
bin
sys
sync
games
man
lp

RHEL and Debian both commonly set UID_MIN to 1000, but always read /etc/login.defs on the host you manage.

Login-capable accounts vs service accounts

Accounts with /bin/bash, /bin/sh, or /bin/zsh can log in interactively (if SSH and PAM allow it):

awk -F: '$7 ~ /\/(bash|sh|zsh)$/ {print $1}' /etc/passwd

root
golinuxcloud

Service accounts often use /usr/sbin/nologin or /bin/false:

awk -F: '$7 ~ /nologin|false/ {print $1}' /etc/passwd | head -6

daemon
bin
sys
games
man
lp

List users with home directories

Each passwd entry stores the home directory in field 6. Print usernames with their configured home:

awk -F: '{print $1, $6}' /etc/passwd

root /root
daemon /usr/sbin
bin /bin
golinuxcloud /home/golinuxcloud

To list only accounts whose home is under /home:

awk -F: '$6 ~ /^\/home\// {print $1, $6}' /etc/passwd

golinuxcloud /home/golinuxcloud

Useful when you are auditing manually created accounts, stale home directories, or orphaned /home folders after user deletion.

Users currently logged in

who, users, and w read session data from utmp—they show who is on the system right now, not every account in /etc/passwd.

w adds idle time and the current command:

w

USER       TTY      FROM           LOGIN@   IDLE   JCPU   PCPU  WHAT
golinuxc   tty2     -              10:43    3:29m  0.11s  0.09s  /usr/libexec/gnome-session-init-worker ubuntu
golinuxc   pts/2    10.0.2.2       10:48    1:24m  0.13s  0.06s  sudo su -

users prints a single line of names; who adds terminal and source host when sessions are active.

On systemd-based hosts, loginctl complements who and w:

loginctl list-users
loginctl list-sessions

UID USER         LINGER STATE
   0 root         no     active
1000 golinuxcloud no     active

2 users listed.
SESSION  UID USER         SEAT  LEADER CLASS   TTY  IDLE SINCE
      1 1000 golinuxcloud seat0 3061   user    tty2 yes  3h 27min ago
      2 1000 golinuxcloud -     3076   manager -    no   -

See recent user logins

who, users, and w show active sessions only. To review recent login history, use last:

last -a | head

For failed login attempts on many distributions:

sudo lastb -a | head

lastb reads /var/log/btmp and usually requires root. On newer minimal Ubuntu/Debian images, last may not be installed by default. On Ubuntu 26.04, install the wtmpdb package if you need login-history tooling:

sudo apt install wtmpdb

Check whether a user exists

Before useradd or a deploy script, confirm the name is free. Start with NSS—works for local and directory users:

getent passwd golinuxcloud

golinuxcloud:x:1000:1000:golinuxcloud:/home/golinuxcloud:/bin/bash

Then use id when you also need UID, GID, and group membership:

id golinuxcloud

uid=1000(golinuxcloud) gid=1000(golinuxcloud) groups=1000(golinuxcloud),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),115(lpadmin)

When the account does not exist, both commands fail:

getent passwd nonexistentuser; echo exit:$?
id nonexistentuser

exit:2
id: 'nonexistentuser': no such user

Local-file check only—use grep -x so root does not match rootless:

grep -x '^golinuxcloud:' /etc/passwd

Users in a group

To see supplementary members of one group:

getent group sudo

sudo:x:27:golinuxcloud

That fourth field is not the full membership picture—users can have a group as their primary GID without appearing there. For primary vs supplementary members, combined member lists, and getent vs /etc/group, use list groups in Linux.

NSS, LDAP, and directory users

On domain-joined hosts, directory users may never appear in /etc/passwd but still show up in getent passwd. Check which backends are configured:

grep '^passwd:' /etc/nsswitch.conf

passwd:         files systemd sss

files is the local /etc/passwd; sss is SSSD; ldap or ad appear on other setups. When in doubt, trust getent passwd over cat /etc/passwd for a complete user list.

Privileged and sensitive accounts

Any account with UID 0 has full root privileges—there should usually be only one:

awk -F: '($3 == 0) {print $1}' /etc/passwd

root

Debian and Ubuntu put sudo access in the sudo group:

getent group sudo

RHEL, Rocky, and AlmaLinux typically use wheel instead:

getent group wheel

On this Ubuntu host wheel is not defined locally—that is expected.

Troubleshooting

References

• getent(1) — get entries from NSS databases
• passwd(5) — password file format
• id(1)
• who(1)
• last(1)
• nsswitch.conf(5)

Summary

Use getent passwd when you want every account NSS knows about; use cut or awk on /etc/passwd when you only care about local files. Filter human accounts with UID_MIN from /etc/login.defs, list homes with awk on field 6, see active sessions with w or loginctl, and check history with last. Confirm a username with getent passwd before id when directory users might be involved. For group membership detail, switch to list groups in Linux.