1 
usermod -e 1 *username*

will have the effect of expiring a user account but 

usermod - L *username*

will lock the said account.

Are there any specific differences between the two? In my opinion, either one of them should achieve the goal of locking out a user from authenticating their account. Why would we need an expiration mechanism when one could lock/or delete the account in question?

Improve this question
4
  • 1
    Imagine a system having many many users in a organization. Some of these users might be contractors who will stop working after a certain date. Rather than continuously keeping track of who's leaving when, you create an account for these contractors and set an expiration date, the date on which these contractors will stop working.
    – GMaster
    Commented Feb 28, 2020 at 12:26
  • @GMaster that makes sense.
    – Weezy
    Commented Feb 28, 2020 at 15:39
  • @GMaster Does "expiry" mean that the user files will also be removed with like what userdel -r would do ?
    – Weezy
    Commented Feb 28, 2020 at 16:33
  • Expiration does not mean userdel -r <username>. The home directory and the account will NOT be removed from /etc/passwd, /etc/group and /etc/shadow files.
    – GMaster
    Commented Feb 29, 2020 at 0:35

1 Answer 1

Reset to default
3

The expiration mechanism is needed to expire the account in the future. Say like a service account that can be used for a week or so.

The locking mechanism works only for local password login, not with other login mechanisms like PAM or ssh key.

man usermod explicitly says if you want to disable an account, you also have to expire it, not just lock it. Therefore, usermod -e 1 username is the correct way to lock an account.

Improve this answer
2
  • Could you please tell me if expiration means the equivalent of running userdel -r <username> meaning the home directory and the account will be removed from /etc/passwd and /etc/shadow files?
    – Weezy
    Commented Feb 28, 2020 at 16:32
  • Expiration does not mean userdel -r <username>. The home directory and the account will NOT be removed from /etc/passwd, /etc/group and /etc/shadow files.
    – GMaster
    Commented Feb 29, 2020 at 0:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .