Lock and Unlock Linux User Accounts: passwd, usermod and faillock

This article is a localized edition of the Japanese original. Read the Japanese original

When you need to temporarily disable a Linux user, the right command depends on whether you want to block only the password or the whole account. Locking with passwd -l still lets the user log in with an SSH key, so it is not enough to shut out a former employee or a possibly compromised account. The commands and behavior in this article were checked against the shadow-utils and linux-pam manual (man) pages as of November 2026.

Run every command below as root. The example user name is alice.

Types of lock

Check the current status

Use passwd -S to check the password status.

sudo passwd -S alice

The second field is the status: L means the password is locked, NP means there is no password, and P means there is a usable password (some distributions show LK and PS instead).

Check the account expiration date with chage -l. If the "Account expires" line shows a date instead of never, the account cannot be used from that date on.

sudo chage -l alice

If you look at /etc/shadow directly, a ! at the start of the second field (the password hash) means the password is locked. Don't edit /etc/shadow by hand; change it with the commands below.

sudo grep '^alice:' /etc/shadow

Lock and unlock the password

To block only password logins, use passwd -l (or usermod -L). This puts a ! in front of the hash so that no password can match it.

# Lock
sudo passwd -l alice

# Unlock (restores the password from before the lock)
sudo passwd -u alice

usermod -L and usermod -U add and remove the ! in the same way.

sudo usermod -L alice
sudo usermod -U alice

As the passwd manual notes, this does not disable the account: the user can still log in with another authentication method such as an SSH key.

Disable the whole account

To block logins including SSH keys, set the account expiration date to a date in the past. The passwd manual recommends usermod --expiredate 1 (which sets the expiration date to January 2, 1970). Combined with a password lock, the account is blocked by both the password and the expiration date.

sudo usermod --lock --expiredate 1 alice

An expired account is rejected by the PAM account check. Over SSH, with UsePAM yes (the default on most distributions), key-based logins are rejected as well.

To reverse it, clear the expiration date and remove the password lock.

sudo usermod --unlock --expiredate '' alice

You can do the same with chage: chage -E 0 sets the expiration date to January 1, 1970, and chage -E -1 removes the expiration date.

sudo chage -E 0 alice
sudo chage -E -1 alice

End sessions that are already logged in

Locking or expiring an account does not disconnect existing sessions. If you need to stop the user right away, terminate their processes.

# End the sessions managed by systemd-logind
sudo loginctl terminate-user alice

# Kill any remaining processes
sudo pkill -KILL -u alice

Check SSH keys and cron too

If you suspect a compromise, in addition to locking the account, check ~alice/.ssh/authorized_keys for keys you don't recognize and run crontab -l -u alice to look for suspicious scheduled jobs.

Set the login shell to nologin

For accounts that should never log in interactively, such as service accounts, set the shell to nologin. The path is /usr/sbin/nologin on both Debian/Ubuntu and RHEL-based systems.

sudo usermod -s /usr/sbin/nologin alice

To revert, specify the original shell (for example /bin/bash). Changing the shell alone may still allow connections that don't use a shell, such as SFTP, so use the expiration date when the goal is to shut a person out.

Automatic lockout after wrong passwords (faillock)

Automatically locking an account after a number of wrong passwords is handled by the PAM module pam_faillock. The older pam_tally2 has been removed from linux-pam.

Settings go in /etc/security/faillock.conf. The main options and their defaults are:

On RHEL 8 and 9 and compatible systems, enable faillock with authselect and then edit faillock.conf.

sudo authselect enable-feature with-faillock
sudo authselect current

On Ubuntu and Debian, pam_faillock is not enabled by default. Enabling it requires editing the authentication settings in /etc/pam.d/, and a mistake can lock everyone out, so keep one root session open while you work and test logging in from another terminal.

Check and clear a lockout

# Show the failure records
sudo faillock --user alice

# Clear the failure records to release the lock
sudo faillock --user alice --reset

A faillock lockout does not show up in passwd -S. If a user can't log in even with the correct password, check the faillock --user records as well.

Cautions

• Don't edit /etc/shadow directly with an editor or echo. If the format breaks, no user may be able to log in. Make changes with passwd, usermod and chage.
• Before locking the root account, make sure you can log in as another administrative user who can use sudo.
• After disabling an account such as a former employee's, clean up the files, cron jobs and authorized_keys owned by that user, and delete the account with userdel once it is no longer needed.

For changing passwords and setting password expiry, see "How to use the Linux passwd command".

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)