User & Group Management

Stop leaving dead accounts around with active SSH keys

🧩 The Challenge

Dealing with the aftermath of an employee leaving is annoying enough without finding out their keys are still valid on half your jump boxes. I spent way too much time tracking down stale entries in /etc/passwd and hidden .ssh directories because someone didn’t follow the offboarding checklist.

💡 The Fix

Use chage to lock the account while keeping the data intact, and leverage a simple loop to audit all shell users for specific shell access. It saves you from manual cleanup when you’re already under the gun.

sudo chage -E 0 username
getent passwd {1000..60000} | awk -F: '$7 ~ /\/bin\/bash/ {print $1}'

⚙️ Why It Works

Setting the expiration date to zero effectively disables the login immediately without needing to delete the home directory right away. It’s much safer than just changing a password since that doesn’t kill existing SSH key sessions.

🚀 Pro-Tip: Pipe that user list into a quick script to check for non-empty .ssh/authorized_keys files.

Linux Tips & Tricks | © ngelinux.com | 9/4/2026