TechEarl

How to Lock and Unlock a User Account on Linux

Disable a login without deleting the account using usermod -L, passwd -l, an expired account, or a nologin shell, and how to reverse each one.

Ishan Karunaratne⏱️ 3 min readUpdated
Share thisCopied
Lock and unlock a Linux user account with usermod -L, passwd -l, account expiry, or a nologin shell, without deleting the account.

When someone leaves or an account is compromised, deleting it immediately can break cron jobs, file ownership, and mail. Locking it blocks access while keeping everything in place. It is a root task:

bash
sudo usermod -L deploy
Root terminal running usermod -L deploy to lock the account, passwd -S deploy showing status L (locked), then usermod -U deploy to unlock it.
usermod -L locks the password; passwd -S reports L for locked; usermod -U reverses it.

Lock the password (blocks password logins)

usermod -L puts a ! in front of the password hash in /etc/shadow, so no password will ever match. passwd -l does the same thing.

bash
sudo usermod -L deploy       # lock
sudo usermod -U deploy       # unlock
sudo passwd -S deploy        # check: L = locked, P = usable password, NP = no password

Important caveat: locking the password does not block SSH key logins. If the user has a key in authorized_keys, they can still get in. For a full lockout you need to block the shell too.

Block the shell (the real lockout)

Set the login shell to nologin, which refuses any interactive session including key-based SSH:

bash
sudo usermod -s /usr/sbin/nologin deploy     # block
sudo usermod -s /bin/bash deploy              # restore

For a complete disable, do both: lock the password and set nologin. Locking the password alone is the most common mistake here, because key auth sails right past it.

Expire the account entirely

To disable an account on or after a date (or right now), expire it:

bash
sudo chage -E 0 deploy        # expired (epoch), blocks all login immediately
sudo chage -E -1 deploy       # remove the expiry, re-enable

Account expiry blocks every login method, password and key alike, which makes it the cleanest single switch. See set password expiry and account aging for the full chage reference.

FAQ

See also

Sources

Authoritative references this article was fact-checked against.

TagsLinuxusermodpasswdUser ManagementSecurity

Found this useful? Pass it on.

Copied

Ishan Karunaratne

Software Systems Architect · Senior Software Engineer · Engineering Leadership

Software systems architect and senior software engineer with more than two decades designing, building, and running production software, Linux systems, and DevOps infrastructure, and lately working AI into the stack. Now a CTO, though what I write here is drawn from the full arc of that work, across architecture, engineering, and operations, not any single job.

More by Ishan →LinkedIn
Keep reading

Related posts

How to schedule a cron job on Linux: edit your crontab, write the five-field cron schedule, and point it at a command to run on a recurring timer.
Linux

How to Schedule a Cron Job on Linux

Schedule a recurring task on Linux with cron: open your crontab, write the five-field schedule, point it at a command, and avoid the environment and day-of-week traps that make jobs run at the wrong time.