I've been tasked with performing a lockdown on a user account (making it impossible to properly login-in to) in a very specific way. Im prohibited from:

a) Altering his password (so passwd -l is out as I take it)

b) Altering its expiration date ( so no chage -E)

c) Changing its shell (no chsh)

I honostly have no idea how to handle this. Any ideas?


The easiest way I can think of is to set the directory permissions of the user's home directory to exclude the executable bit (0xx, 2xx, 4xx, 6xx would all work.) If the user tries to log in, they'll get an error like this:

Could not chdir to home directory /home/erik: Permission denied

On the assumption that: - the user is logging in via ssh - you need to prohibit the user from logging in

The DenyUsers directive in sshd_config should be the path forward.


You could insert the 'logout' command to the 1st line of .bashrc

sed -i '1i logout' /home/jdoe/.bashrc

To rollback (be sure 'logout' is at 1st line):

sed -i '1d' /home/jdoe/.bashrc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.