List Accounts with Login Shells

You need to separate human or interactive accounts from service accounts in a passwd-style file.

Command

awk -F: '$7 ~ /(bash|sh|zsh)$/ {printf "%s %s\n", $1, $7}' fixtures/user-access-audit/etc/passwd

Before you run this

Risk: safe. Do not disable accounts from this list alone; confirm ownership, automation, and operational purpose first.

Expected output

Usernames and login shells for accounts that can start an interactive shell.

System impact

Nothing changes. The command reads a fixture-local passwd stub and prints accounts with shell-like login programs.

Recovery / rollback: no state is changed.

When to use it

Use during server handoff, user access reviews, and first-response checks before changing accounts.

When not to use it

Do not disable accounts from this list alone; confirm ownership, automation, and operational purpose first.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ sed -n '1,8p' sample-files/user-access-audit/etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
alex:x:1000:1000:Alex Admin:/srv/example/users/alex:/bin/bash
deploy:x:1001:1001:Deploy Bot:/srv/example/users/deploy:/bin/bash
reports:x:1002:1002:Reports Service:/srv/example/users/reports:/usr/sbin/nologin
breakglass:x:1003:1003:Break Glass:/srv/example/users/breakglass:/bin/bash
backup:x:1004:1004:Backup Service:/srv/backup:/usr/sbin/nologin

$ awk -F: '$7 ~ /(bash|sh|zsh)$/ {printf "%s %s\n", $1, $7}' sample-files/user-access-audit/etc/passwd

root /bin/bash
alex /bin/bash
deploy /bin/bash
breakglass /bin/bash

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.