An employee goes on leave or hands over their work. No one may log in as them, but the data and the running programs must stay, so it is too early to delete the account.
Logins are closed by several settings, and each one covers its own part. Two of them are changed by usermod:
| Command | What it closes |
|---|---|
sudo passwd -l name |
password login: a ! goes before the password in /etc/shadow, and the password itself is kept |
sudo usermod --expiredate 1970-01-02 name |
the whole account: it has expired, and no login works, with a password or a key |
sudo usermod -s /usr/sbin/nologin name |
the shell: nologin starts instead |
passwd -u removes the ! and brings the old password back. The Account expires line of sudo chage -l name shows the expiry, and sudo usermod --expiredate '' name removes it. Do not use 1970-01-01: some programs read day 0 as an expiry date, others as no expiry at all.
An SSH key login never asks for a password. The keys a user is let in with are listed in their authorized_keys file, ~/.ssh/authorized_keys, and locking the password does not touch them. The account's running processes keep going too: all these settings are checked at the moment of login. ps -u name shows the processes.
The employee dev is leaving. No one may log in as dev by password or by SSH key, and the data must be kept. You ran sudo passwd -l dev. What else do you do?
-
-rdeletes the home directory, and the data must be kept. Key login can be closed without deleting the account. -
passwd -lputs!before the password, and key login never asks for one. The keys in~/.ssh/authorized_keyskeep working. -
A new password removes the lock and opens password login. It does not touch the key.
Locking the password closes one way in, and the key is another. An account expiry date (usermod --expiredate) closes both, and authorized_keys is removed separately when key login must be closed for good.
Key points
- The password, the account expiry, the shell, and SSH keys are closed by different settings, each on its own.
-
passwd -lkeeps the old password, and the account's running processes keep working.