Lock, unlock or disable a Linux user account

Sometimes you need to stop an account from logging in but keep its files, for example while a contractor is between projects or while you investigate odd activity. Linux has several ways to do this, and they do not all block the same things. This guide explains each method, which one to use, and how to undo it.

Before you start

• A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
• An SSH session as root or a sudo user.
• The username, for example deploy. Never lock the only account you use for sudo.

Which method blocks what

• Lock the password (passwd -l or usermod -L): password logins fail. SSH key logins can still work on many setups.
• Expire the account (usermod -e): all logins through PAM fail, including SSH with keys.
• Set a nologin shell (usermod -s /usr/sbin/nologin): interactive logins are refused. Some services, such as SFTP with internal-sftp, may still work.

For a full block, combine locking with expiry.

Lock the password

Either command works on all target systems:

sudo passwd -l deploy

sudo usermod -L deploy

Both add a ! at the start of the password hash in /etc/shadow, so no typed password can ever match. The original hash stays, so unlocking restores the old password.

Expire the account

Setting an expiry date in the past blocks every login method that goes through PAM, including SSH keys:

sudo usermod -e 1 deploy

1 means 2 January 1970, a date safely in the past. You can also schedule a future cut-off, useful for temporary staff:

sudo usermod -e 2026-12-31 deploy

Check the expiry with:

sudo chage -l deploy

Account expires                                         : Jan 02, 1970

Set a nologin shell

To stop interactive shells for an account that only runs a service:

sudo usermod -s /usr/sbin/nologin deploy

Anyone trying to log in sees This account is currently not available. and is disconnected. The path is the same on Ubuntu, Debian, AlmaLinux and Rocky.

Disable SSH keys as well

A locked password alone does not always stop key logins. To be sure, also move the key file aside:

sudo mv /home/deploy/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys.disabled

Or, for a block managed in one place, add a DenyUsers deploy line to a file in /etc/ssh/sshd_config.d/, test with sudo sshd -t and reload SSH.

End current sessions

Locking does not kick out someone who is already logged in. List their sessions and end them:

who | grep deploy
sudo pkill -KILL -u deploy

The second command stops every process the user runs, including SSH sessions. Stop any service that runs as the user first if it must keep running under a new account.

Check the status

sudo passwd -S deploy

On Ubuntu and Debian:

deploy L 2026-11-09 0 99999 7 -1

The L means locked. P means a usable password and NP means no password. On AlmaLinux and Rocky the codes are LK, PS and NP, with a short note in brackets. Combine this with chage -l for expiry and getent passwd deploy for the shell.

Unlock the account

Reverse each step you took:

sudo passwd -u deploy
sudo usermod -e "" deploy
sudo usermod -s /bin/bash deploy

• passwd -u (or usermod -U) removes the ! from the hash.
• usermod -e "" clears the expiry date.
• usermod -s /bin/bash restores a normal shell.

If you moved the SSH key file, move it back:

sudo mv /home/deploy/.ssh/authorized_keys.disabled /home/deploy/.ssh/authorized_keys

Check it works

From your own computer, try to log in as the locked user:

ssh deploy@203.0.113.10

With an expired account the connection is closed, often with Your account has expired; please contact your system administrator. After unlocking, the same command logs you in normally.

Troubleshooting

• User still logs in with an SSH key after passwd -l: password locking does not cover keys. Expire the account with usermod -e 1 or disable the key file.
• "passwd: unlocking the password would result in a passwordless account": the account never had a password. Set one with sudo passwd deploy.
• Service stopped after you changed the shell: the service needed a shell to run its scripts. Restore the shell, or run the service under a dedicated system account.
• Locked user still has open sessions: locking only affects new logins. End sessions with pkill -KILL -u deploy.

Next steps

• Remove the account for good: Delete a user and their files on Linux.
• See who has logged in recently: See who is logged in (w, who, last).
• Review every account on the server: List users and groups on Linux.