Delete a user and their files on Linux

When someone leaves the team or an app is retired, its account should go too. Old accounts with working passwords or SSH keys are an easy way in for an attacker. This guide shows how to remove a user safely on Ubuntu, Debian, AlmaLinux and Rocky Linux, including the steps people often skip: stopping their processes, keeping a backup and cleaning up files outside the home folder.

Before you start

• A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
• An SSH session as root or another sudo user. Never delete the account you are logged in as.
• The exact username. Check it with getent passwd deploy, using your own name in place of deploy.

Check what the user is running

A user who is still logged in or running jobs will block a clean delete. List their processes:

ps -u deploy -o pid,etime,cmd

Also check for cron jobs and services that run as this user:

sudo crontab -l -u deploy
systemctl list-units --type=service --all | grep -i deploy

If an app runs under the account, stop and disable its service first, or move it to another account. Otherwise it will break when the user is gone.

Lock the account and stop its processes

Lock the password so nobody can log in while you work:

sudo usermod -L deploy

Then end everything the user is running:

sudo pkill -KILL -u deploy

Run ps -u deploy again. It should print only the header line.

Back up the home folder

Keep a compressed copy in root's home folder:

sudo tar -czf /root/deploy-home-$(date +%F).tar.gz -C /home deploy
ls -lh /root/deploy-home-*.tar.gz

Move the archive off the server if you want to keep it long term.

Delete the user

Ubuntu and Debian

deluser is the friendly tool on these systems:

sudo deluser --remove-home deploy

This removes the account, its home folder and its mail spool. To also remove every file the user owns anywhere on the disk, use --remove-all-files instead. That option scans the whole filesystem, so it is slow and needs care.

AlmaLinux and Rocky Linux

Use userdel with -r:

sudo userdel -r deploy

-r removes the home folder and mail spool together with the account. userdel works the same way on Ubuntu and Debian if you prefer one command everywhere.

If the user owns a private group with the same name and no one else is in it, both tools remove that group too.

Find leftover files

Files the user created outside their home folder, for example in /var/www or /tmp, stay on disk. After the account is deleted they show a number instead of a name in ls -l. Find them by the old user ID. Get the ID before you delete the account:

id -u deploy

After deleting, search for files with no owner, staying on the main filesystem:

sudo find / -xdev -nouser -ls 2>/dev/null

Or search for the specific old ID, here 1001:

sudo find / -xdev -uid 1001 -ls 2>/dev/null

Decide for each result whether to delete it or hand it to another account with chown. For example, to give a site folder to the www-data user:

sudo chown -R www-data:www-data /var/www/example.com

Remove other traces

Check these places for references to the old name:

• /etc/sudoers and /etc/sudoers.d/: remove any lines for the user with sudo visudo or by deleting their drop-in file.
• AllowUsers lines in /etc/ssh/sshd_config or files in /etc/ssh/sshd_config.d/.
• Database logins, for example a MySQL user with the same name.

Check it works

getent passwd deploy
ls -d /home/deploy

The first command prints nothing and the second reports No such file or directory. The account and home folder are gone. Run getent group deploy to confirm the private group was removed too.

Troubleshooting

• "user is currently used by process": the user still has running processes. Stop their services and run sudo pkill -KILL -u deploy, then try again.
• "userdel: deploy mail spool (/var/mail/deploy) not found": this is only a notice. The user never had mail. The delete still succeeded.
• "group deploy not removed because it has other members": other users are in that group. Remove the group later with sudo groupdel deploy once it is empty, or keep it.
• An app stopped working after the delete: it ran under that account. Recreate a service account for it and fix file ownership with chown.
• You deleted the wrong home folder: restore it from the archive with sudo tar -xzf /root/deploy-home-<date>.tar.gz -C /home, after recreating the account.

Next steps

• Review who else has access: List users and groups on Linux.
• Suspend rather than delete next time: Lock, unlock or disable a Linux user account.
• Check who has been logging in: See who is logged in (w, who, last).
• Work through the rest of the basics with the Linux VPS security checklist.