User & Group Management

Stop creating users who can still SSH in after you fire them

🧩 The Challenge

Getting the ticket to terminate a dev’s access is easy, but making sure they’re actually locked out of every server is a nightmare. I’ve definitely had that “oh no” moment when I realized someone still had a valid session open after I deleted their user account.

💡 The Fix

Instead of just deleting the account or manually changing the shell, you should use the lock command to disable the password and account credentials immediately. It stops them cold without you having to dig through config files on twenty different boxes.

passwd -l <username> && usermod -s /sbin/nologin <username>

⚙️ Why It Works

Setting the login shell to nologin effectively kills any attempt to spawn a shell via SSH or local console, while locking the password ensures the account can’t be authenticated even if someone keeps a stale key around. It’s the cleanest way to neutralize an account while keeping the home directory intact for potential audits later.

🚀 Pro-Tip: Keep the home directory around for a month before you run userdel so you don’t lose that one critical script they buried in their trash folder.

Linux Tips & Tricks | © ngelinux.com | 11/8/2026