View logged in users:

w

Show if a user has ever logged in remotely:

lastlog
last

View failed logins:

faillog -a

View local user accounts:

cat /etc/passwd
cat /etc/shadow

View local groups:

cat /etc/group

View sudo access:

cat /etc/sudoers

View accounts with UID 0:

awk -F: '($3 == "0") {p rint}' /etc/passwd
egrep ':0+' /etc/passwd

View root authorized SSH key authentications:

cat /root/.ssh/authorized_keys

List of files opened by user:

lsof -u <USER NAME>

View the root user bash history:

cat /root/.bash_history