I'm uing ubuntu 12.04 desktop. I have 3 users: user1(administrator), user2(standard) and guest. I wanted to disable user1 and enable user2 which auto logs on with no password but after I did that I can't login to user1 and user2 accounts except the guest session user. I'm striped off every administrative privileges. I don't know which options are available to me and how do I enable root or user which is an administrator?


5 Answers 5


Expire Account

Let the account expire to disallowing a user from logging in from any source including ssh:

# disallow peter from logging in
sudo usermod --expiredate 1 peter

This is how you can reenable that account:

# set expiration date of peter to Never
sudo usermod --expiredate "" peter

Lock a Password

To disable / lock the password of user account use below command. This will not disallow ssh-access on Ubuntu. This prepends a ! to the password hash so that no password will match it anymore.

# take away peters password
sudo passwd -l peter

To unlock him:

# give peter back his password
sudo passwd -u peter

Expire a Password

This command seems to differ across platforms. On Ubuntu, expiring a password will command the user to make up a new one once he logs in. This is not suitable for disabling an account.

# make peter think of a new password on login
sudo passwd -e  YYYY-MM-DD peter
  • You should merge locking a password and expiring an account into one command as explained in @vorburger's answer (usermod -L -e 1 [username]) and (usermode -U -e "" [username])
    – Basil A
    Commented Apr 27, 2020 at 19:51
  • But I think the way you make the ssh distinction is good.
    – Basil A
    Commented Apr 27, 2020 at 19:52
  • Note that due historical reasons / mishap the value 0 for --expiredate is poorly defined. Most programs consider it equal to unix epoch 0 but some programs may incorrectly consider it as "not disabled" which may cause a security vulnerability. It's better to avoid the value 0 for expiry time. Commented Jul 4 at 9:00

Use this to lock an account:

sudo usermod -L -e 1 [username]

and this to unlock an account so locked:

sudo usermod -U -e "" [username]


(Disabling and locking a user account both mean the same thing.)

To disable / lock the user account use below command:

sudo passwd -l [user_name]


sudo passwd -l samual

To put an expire date to an user account so that it automatically gets disabled / locked.

sudo passwd -e  YYYY-MM-DD [user_name]


sudo passwd -e  2013-05-31 samual

To re-enable a disabled user, issue the passwd command with the -u option.

sudo passwd -u [username]


sudo passwd -u training

To enable the root account and change the root password use below steps.

1) su -
2) passwd

Enter the new password for root account and then exit. if this does not solve the issue let me know.

Please feel free to let me know if you need anything else or any further clarification.

  • When I do that it ask for password and root is not enabled, user1 which is admin is also disabled.
    – user150330
    Commented Apr 18, 2013 at 13:54
  • @user150330 I have updated the answer check at the end of it.
    – Hrish
    Commented Apr 18, 2013 at 14:08
  • @user150330 Is your problem solved?
    – Hrish
    Commented Apr 26, 2013 at 5:46
  • 4
    from the man page: -l Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account's expire date to Jan 2, 1970).
    – Levon
    Commented Feb 6, 2014 at 21:43
  • 3
    I can confirm that passwd -l ... will not stop keyed authentication. Just tested it.
    – Oli
    Commented Mar 13, 2014 at 8:53

In addition to previous solutions, another way is to replace bash for the user you want to disable in the /etc/passwd file by /bin/false

Edit the /etc/passwd file, find the line with your user then change /bin/bash by /bin/false.

Don't update any other lines

  • Your answer would delete root. Is this what you intended?
    – David DE
    Commented Apr 12, 2023 at 8:18
  • I didn't say to replace content of /etc/passwd, juste replace /bin/bash for the user you want to disable by /bin/false. I update my anwser to make it clearer
    – Jos
    Commented Apr 13, 2023 at 7:37

Tested in Ubuntu 18.04

Use case: disable an account so that user is unable to log in.

with root privileges: "passwd -l -e username"

with that the account is locked and also the old password is expired

to get the user back: "passwd -u username"

after this, the user has to enter the old password and enter a new password to log back in

hope this helps

N.B. when you lock an account, trying to SSH with an identity file, e.g. abc.pem, also fails

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .