Re: determine when user account created?

From: Tony Walton (tony.walton_at_s_u_n.com)
Date: 10/28/04 

Date: Thu, 28 Oct 2004 12:08:00 +0000 (UTC)

User-Agent: Unison/1.5.2

On 2004-10-27 17:40:40 +0100, Dave Uhring <daveuhring@yahoo.com> said:

> On Wed, 27 Oct 2004 17:02:28 +0100, Tony Walton wrote:
>
>>
>> The symlink was created at about 21:17 on the same day, sure. How do
>> you know it wasn't deleted at 21:14 and re-created three minutes later?
>> All you're looking at there is the creation date/time of a symlink.
>
> I agree that UFS does not easily provide creation time, if at all.

Miss out "easily" and "if at all" from that statement and you'll be
100% correct.

> But I
> do know

How, just by looking at the symlink date?

> that the symlink in the user's home directory was created within a
> couple of minutes after running useradd. How much precision is necessary
> to provide an answer to the OP's question?

Sorry - I missed out part of my argument (I assumed wrongly you'd know
what I meant). What I meant was "how do you know that symlink wasn't
CREATED SIX YEARS AGO, deleted at 21:14 and re-created three minutes
later?". You don't, of course, unless you happen to have installed the
OS yourself and have first hand knowledge of what's been done
subsequently (which is cheating; the symlink date didn't tell you any
of this).

The issue isn't one of three minutes' precision, it's one of there
being absolutely no way of knowing what happened prior to 21:17. The
answer to the OP's question is "you can't".

>
>> Same goes for the /etc/chroot symlink. You're assuming that those
>> creation dates and times are reliable
>>
>> # ls -l /etc/chroot
>> lrwxrwxrwx 1 root other 17 Oct 27 17:00 /etc/chroot ->
>> ../usr/bin/chroot
>>
>> This OS was installed a *lot* more than a minute ago (I was there!)
>
> I suppose that one could delete and create a new symlink or even that a
> patch could do that. But it's unlikely that all those symlinks in /etc
> would be so affected unless done deliberately.

Which might very easily happen in a user's ho directory. Agreed, the
/etc/chroot link is less likely to have been changed, but as an
illustration of how to tell when the OS was installed it's frankly not
of very much use. 

-- 
Tony

Relevant Pages

  • Re: determine when user account created?
    ... > I agree that UFS does not easily provide creation time, ... What I meant was "how do you know that symlink wasn't ... The issue isn't one of three minutes' precision, ...
    (comp.unix.solaris)
  • Re: determine when user account created?
    ... > I agree that UFS does not easily provide creation time, ... > do know that the symlink in the user's home directory was created within a ... Why do you expect a symlink from ... purposes -- .bash_profile is only for the login shell, ...
    (comp.unix.solaris)
  • Re: determine when user account created?
    ... > I agree that UFS does not easily provide creation time, ... > do know that the symlink in the user's home directory was created within a ... Why do you expect a symlink from ... purposes -- .bash_profile is only for the login shell, ...
    (comp.sys.sun.admin)
  • Re: determine when user account created?
    ... >> symlink in my user's home directory. ... > The symlink was created at about 21:17 on the same day, ... I agree that UFS does not easily provide creation time, ...
    (comp.sys.sun.admin)