How do I completely disable an account?
passwd -l will not allow anyone to log into an account using a password but you can still log in via private/public keys. How would I disable the account completely? As a quickfix I renamed the file to
authorized_keys_lockme. Is there another way?
How do I completely disable an account?
The correct way according to
usermod --lock --expiredate 1970-01-02 <username>
(Actually, the argument to
--expiredate can be any date before the current date in the format
--locklocks the user's password. However, login by other methods (e.g. public key) is still possible.
--expiredate YYYY-MM-DDdisables the account at the specified date. According to
man shadow 51970-01-01 is an ambiguous value and shall not be used.
I've tested this on my machine. Neither login with password nor public key is possible after executing this command.
To re-enable the account at a later date you can run:
usermod --unlock --expiredate '' <username>
Here is another simple way. You can set the user account expired. This will prevent both password-based and ssh key-based logins for the account, but does not touch the password.
To lock the account:
# chage -E 0 username
The user account 'username' will be locked out on the system. To re-enable the user account, do the following.
To unlock the account:
# chage -E -1 username
The user account 'username' will be re-enabled on your system with the same password as before. The 'chage' binary is part of the shadow-utils package on Red Hat Linux, or the passwd package on Debian Linux.
I don't have sufficient rep to comment on Legate's answer, but I wanted to share that this answer helped us with another use case:
1.) account in question is a local service account running an application, not an end user account.
2.) end users ssh in as themselves, and
sudo /bin/su <user> to become user and administer application due to an audit trail requirement that service account cannot have direct login ability.
3.) service account must have a valid shell (
/sbin/nologin), because an Enterprise Scheduling Platform (agent runs as root locally) must be able to
su - <user> and does not have the
su -s /bin/bash <user> ability that a full shell does, and is needed to run jobs remotely for larger batch operations that encompass multiple servers and databases.
passwd -l <user>
Doesn't satisfy constraints because public key authentication bypasses PAM and still allows direct login.
usermod -s /sbin/nologin <user>
Doesn't satisfy constraints becausebreaks the enterprise scheduler
usermod --lock --expiredate 1970-01-01 <user>
This is our winner. Remote login disabled, yet root can still
su <user>, as can other users via
sudo so the scheduler functions properly and authorized end users can become the target service account as needed.
Thank you for the solution!
To delete entirely it use
Please note that if you delete an account there is a risk that its user ID will still be used in the file system somewhere and a new user would inherit ownership of those files if it came in under that same user id.
You would want to change the owner of any files that are owned by the deleted user.
If you would like to add the user back later, save its lines from
/etc/passwd (and on Solaris
/etc/shadow) to temporary files such as
That way when you add it back you can use the same user id and the same password (which is encrypted in one of the above files)
Disclaimer: I learned UNIX on my own so I would not be surprised if there is a better way to temporarily disable the user. In fact I don't even know what the private/public keys are you are talking about. Also I am sure there is a
find command that can be used for looking up the files with that owner userid
Has anyone tried doing it via ssh_config? Maybe this could help http://www.techrepublic.com/blog/opensource/set-up-user-accounts-quickly-and-securely/86
Also, ensure that PasswordAuthentication is set to no as well, to force all logins to use public keys.