How to list and filter users in Linux

Where Linux keeps its users

Linux is the system that runs most servers. It stores its accounts in a plain text file named /etc/passwd. Each line is one user. A line has several parts split by a colon, like this:

john:x:1001:1001:John Smith:/home/john:/bin/bash

From left to right, the parts are: user name, a password marker, user ID number, group ID number, a comment, the home folder, and the login shell (the program that starts when the user logs in).

Steps

1. Open a terminal on your server, or connect with SSH.
2. List every user:

cat /etc/passwd

This prints the whole file.

3. Show only the user names:

cut -d: -f1 /etc/passwd

The cut command splits each line at the colon and keeps part one.

4. Sort the names in A to Z order:

cut -d: -f1 /etc/passwd | sort

The bar sends the result of one command into the next.

5. Count the users:

cut -d: -f1 /etc/passwd | wc -l

The wc -l part counts lines.

Filter the list

• Find one user by name:

  grep '^john:' /etc/passwd

  This shows only the line that starts with john.
• Show only real people (user ID 1000 or higher on most systems):

  awk -F: '$3 >= 1000 {print $1}' /etc/passwd

  This prints the name when the third part is 1000 or more.
• Show users who can log in with a shell:

  grep -v -E 'nologin|false' /etc/passwd | cut -d: -f1

  This hides accounts that are blocked from logging in.

Other helpful commands

• who shows who is logged in right now.
• last shows recent logins.
• getent passwd lists users, including ones from other sources.
• id john shows the ID and groups of one user.

Quick recap

• Users are stored in /etc/passwd.
• Use cut -d: -f1 to see only names.
• Use grep to find one user.
• Use awk to show users with ID 1000 or higher.
• Use who and last to see logins.