This short article explains how to disable a user account on Linux. When you don't want to permanently remove a user, but just want to lock the account so it can no longer log in and use the system, the following may be of help. The user can still do certain things—such as having mail automatically delivered to their mailbox—but they won't be able to log in with their account or retrieve their mail.

Modern Linux systems store encrypted user passwords in /etc/shadow, and the quickest way to disable a user is to modify the password stored there. Normally, an active user account in /etc/shadow looks something like this:

user:$1$eFd7EIOg$EeCk6XgKktWSUgi2pGUpk.:13852:0:99999:7:::

The second field is the encrypted password.

If we modify the password, replacing it with "*" or "!", the account will become unusable, meaning it can no longer be logged into with that account and password. For example, like this:

user:*:13852:0:99999:7:::

This method is the least recommended, because if you do this, you'll find that the original user password is lost when you later decide to re-enable the account (of course, you could choose to store the encrypted string somewhere else). From this perspective, using the following command to disable an account is probably better:

Bash
passwd <username> -l

Once the operation succeeds, the console will output "Password changed." In fact, this operation simply modifies the shadow file by adding a "!" in front of the original encrypted password, like this:

user:!$1$eFd7EIOg$EeCk6XgKktWSUgi2pGUpk.:13852:0:99999:7:::

Of course, we can do this by hand directly, if we're willing ;-). If you plan to re-enable this account, just use the following command to unlock it:

Bash
passwd <username> -u

Or simply delete the "!" in front of the encrypted user password in the /etc/shadow file.

On a side note, someone pointed out in a comment that passwd -l doesn't really disable a user—it just makes the password impossible to verify. If the user authenticates with an RSA key, it still works.

The correct approach should be:

Bash
usermod -e 1 <username>

Also, I personally think a better method is:

Bash
usermod -L <username>
This locks the user.

And:

Bash
usermod -U <username>
This unlocks the user.

Of course, if you don't need any of this and intend to permanently remove a user, you just execute the command:

Bash
userdel <username>

This command preserves the user's files (including the home directory, mail, and so on). Or execute the following command—this will delete all of that user's files in the system:

Bash
userdel -r <username>

Before running this command, note which directory the user has set as their home directory. From personal experience, I once ran this command and ended up crashing the entire system, because that guy had set "/" as his home directory ;-).

Original English article: http://www.ducea.com/2007/12/05/howto-disable-a-user-account-in-linux/

Additionally, here are two commands you might need:

Add a user to a group

Bash
usermod -a -G group_name user_name

Remove a user from a group

Bash
gpasswd -d user_name group_name

A user must belong to at least one group, so it's probably not possible to strip a user of all their groups — at best you can switch them to a different group. The usage is:

Bash
usermod -G group_name user_name
This effectively refreshes the group.

You can also check a user's groups with

Bash
id user_name