User & Group Management

Stop locked-out accounts from creeping into your auth logs

🧩 The Challenge

Dealing with a service account that kept trying to authenticate after I explicitly expired the shadow entry has been a recurring nightmare. You think you’ve killed access, but the system keeps trying to validate those credentials against PAM, cluttering up your logs with noise.

💡 The Fix

Just lock the password hash with a bang in the shadow file instead of relying on expiry dates. It keeps the account alive for the system but denies any login attempts immediately.

passwd -l <username>

⚙️ Why It Works

Setting the password field in /etc/shadow to start with an exclamation point makes it impossible to provide a matching hash, effectively breaking the authentication path without deleting the user. It’s the fastest way to kill a runaway process account that needs its UID to remain intact for file ownership.

🚀 Pro-Tip: Use usermod -L to lock the account if you want to be extra clear about your intent in the scripts.

Linux Tips & Tricks | © ngelinux.com | 11/10/2026