From man usermod:

Note: if you wish to lock the account (not only access with a password), you should also set the EXPIRE_DATE to 1.

  • Why should we expire a locked account to totally prevent access to the account?
  • What will happen if I do not expire a locked account?
up vote 14 down vote accepted

usermod -L actually only locks the user's password, so user still is able to login using other methods for example an ssh session which uses public key authentication.

But if you set the EXPIRE_DATE to 1 the account will be expired entirely and the user is not able to use it in any way. This is because 1 is equal to it expiring at1970-01-01 00:00:01.

Because ssh keys don't care about passwords you need the account to die instead.

The old wisdom was change the user's shell to /bin/false; however this doesn't actually work.

  • "change the user's shell to /bin/false; however this doesn't actually work"[citation needed] – user60561 Oct 13 at 0:25
  • 3
    @user60561 some ssh commands don't use the shell, like forward ports. – Joshua Oct 13 at 1:00

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.