Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am having a problem on the server (CentOS 6, Plesk 11.5) where a particular user is using a mass mailer and is blacklisting our IP address. I have tried to delete this user using:

/usr/sbin/userdel test

but it returns a message saying that the user is currently logged in. I thought ok, kill the process. So I tried:

pkill -u test

and also locked the account using:

passwd -l test

which will hopefully stop him logging into the system in future.

Still saying user is logged in. How can I log this user out to enable me to delete him off the system?

share|improve this question
    
You may want to lock the account but keep it around. This could make it easier to find out what exactly that user has been doing (especially if there is a legal action). –  Gilles Jul 21 at 22:44

4 Answers 4

up vote 1 down vote accepted

First grep all the 'test' user's process and kill -9 all pid's then delete the user.

pgrep -u test
ps -fp $(pgrep -u test)
killall -KILL -u test
userdel -r test
share|improve this answer
    
Thank you msnfreaky –  user1532468 Jul 21 at 16:42
passwd -l <user>

doesn't stop all possible means of logging in. For example, if they log in using ssh with public keys they can still login as they won't need a password.

To stop the user logging in again, edit the /etc/passwd file and remove the user or change the 7th column to /sbin/nologin.

Run:

ps -u <user>

to see what process the user is still using and kill them all of them. You may have to use:

kill -s 9 <pid>

to force the process to stop.

share|improve this answer
    
ps -u <user> returns 21398 ? 00:00:01 sshd 21408 ? 00:00:08 sshd 21412 ? 00:00:03 sshd 21416 ? 00:00:00 sshd 21418 ? 00:00:00 sshd 21422 ? 00:00:01 sshd 21424 ? 00:00:03 sshd 21426 ? 00:00:03 sshd do i just kill each process? thanks –  user1532468 Jul 21 at 12:02
    
Yes. Kill them all. Also ps -AF | grep <user> may show a few more as it will show processes with the username in their arguments. –  garethTheRed Jul 21 at 12:27
    
For those of us scared to touch /etc/passwd directly, sudo /usr/bin/chsh -s /sbin/nologin baduser also works (chsh: change shell). –  Ulrich Schwarz Jul 21 at 13:14

Have you tried killing all the user's processes with the SIGKILL?

pkill -KILL -u username
share|improve this answer
    
Tried what you suggested numeral, but whe I run command ps -u <user> to check, the processes are still running. Thanks –  user1532468 Jul 21 at 12:05
    
That's weird. SIGKILL and SIGABORT can't be ignored. Honestly not sure. –  numeral Jul 21 at 12:08
    
@user1532468 - did you run the commands as root? –  Wilf Jul 21 at 12:18
    
@Wilf yes I run as root –  user1532468 Jul 21 at 16:42

passwd -l <user> does not disable the account.as gareth said the user may still can login using another authentication token such as SSH key. to disable this account you should use usermod --expiredate 1 this set the account expire date to 1970. Now you should kill all processes the user is started. running:

$pgrep -u Foo will print all processes that the user Foo is started. running:

$kill -9 <pid> will sent SIGKILL signal which kill that process. Now Run:

$pgrep -u Foo | xargs kill -9

this will get all process ids of user Foo and kill them all.

OR:

$kill -9 -u Foo

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.