Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 11 down vote favorite
6

How do i completely disable an account? passwd -l will not allow anyone to log into an account using a password but you can still log in via private/public keys. How would i disable the account completely? As a quickfix i renamed the file to authorized_keys_lockme. Is there another way?

share|improve this question
1  
Are you planning on re-enabling it eventually? System lockdowns? If not, I'd simply remove the account. – Ken Feb 20 '11 at 2:30

4 Answers

up vote 11 down vote accepted

The correct way according to usermod(8) is:

usermod --lock --expiredate 1970-01-01 <username>

(Actually, the argument to --expiredate can be any date before the current date in the format YYYY-MM-DD.)

Explanation:

  • --lock locks the user's password. However, login by other methods (e.g. public key) is still possible.

  • --expiredate YYYY-MM-DD disables the account at the specified date.

I've tested this on my machine. Neither login with password nor public key is possible after executing this command.

share|improve this answer
up vote 6 down vote

Lock the password and change the shell to /bin/nologin. 

sudo usermod --lock --shell /bin/nologin username

(Or more concisely, sudo usermod -L -s /bin/nologin username.)

share|improve this answer
How do i 'change the shell to /bin/nologin.'? – acidzombie24 Feb 20 '11 at 3:47
5  
@mattdm This is not a complete solution, as a user can still specify a command to be executed. For example ssh username@hostname /bin/bash will give the user a bash prompt, regardless of the default shell. – phunehehe Feb 20 '11 at 4:07
2  
@phunehehe — have you tried it? You'll get, in the log, "User [username] not allowed because shell /bin/nologin does not exist". – mattdm♦ Feb 20 '11 at 13:56
2  
As far as I know, the invalid-shell behavior isn't actually documented. On the other hand, the man page says that if the password is has a leading !! on Linux the account will be treated as locked, and that doesn't actually work. So, y'know, documentation and reality are only approximate matches anyway. :) – mattdm♦ Feb 20 '11 at 15:35
1  
sudo chsh -s /bin/nologin would be better than editing /etc/passwd by hand. Also, on some systems, it's /sbin/nologin. – Mikel Feb 20 '11 at 21:42
show 5 more comments
up vote 1 down vote

To delete entirely it use userdel.

Please note that if you delete an account there is a risk that its user ID will still be used in the file system somewhere and a new user would inherit ownership of those files if it came in under that same user id.

You would want to change the owner of any files that are owned by the deleted user.

If you would like to add the user back later, save its lines from /etc/passwd (and on Solaris /etc/shadow) to temporary files such as /etc/passwd_deleted.

That way when you add it back you can use the same user id and the same password (which is encrypted in one of the above files)

Disclaimer: I learned UNIX on my own so I would not be surprised if there is a better way to temporarily disable the user. In fact I don't even know what the private/public keys are you are talking about. Also I am sure there is a find command that can be used for looking up the files with that owner userid

share|improve this answer
1  
google authorized_keys or try reading this eng.cam.ac.uk/help/jpmg/ssh/authorized_keys_howto.html basically instead of using a password, you put your publuc key in that file and when you connect with ssh you will automatically be logged in if the one of the public matches your current private key – acidzombie24 Feb 20 '11 at 3:50
up vote 0 down vote

Has anyone tried doing it via ssh_config? Maybe this could help http://www.techrepublic.com/blog/opensource/set-up-user-accounts-quickly-and-securely/86

Also, ensure that PasswordAuthentication is set to no as well, to force all logins to use public keys.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.