Why should we expire a locked account to totally prevent access?

Question

From man usermod:

Note: if you wish to lock the account (not only access with a password), you should also set the EXPIRE_DATE to 1.

Why should we expire a locked account to totally prevent access to the account?
What will happen if I do not expire a locked account?

score 13 · Accepted Answer · edited Oct 13 '18 at 03:41

13

usermod -L actually only locks the user's password, so user still is able to login using other methods for example an ssh session which uses public key authentication.

But if you set the EXPIRE_DATE to 1 the account will be expired entirely and the user is not able to use it in any way. This is because 1 is equal to it expiring at1970-01-01 00:00:01.

edited Oct 13 '18 at 03:41

Tim

32,861
27
118
178

answered Oct 12 '18 at 17:23

Ravexina

55,668
25
164
183

1

How about usermod -L -e 300 username ? The account will be expired entirely? – Sinoosh Oct 12 '18 at 18:18
1

@Sinoosh it's somehow the same. the expire date would be set at Oct 28, 1970 which makes account expired. – Ravexina Oct 12 '18 at 18:25
Thank you, could you tell me how can i login to a locked account by ssh ? – Sinoosh Oct 12 '18 at 18:37
1

Read these: How to create multiple ssh keys?, How do I set up SSH authentication keys? and How can I set up password-less SSH login?. – Ravexina Oct 12 '18 at 18:40
1

@Ravexina It would be better if you actually called it "SSH public key authentication" in your answer, because it's the authentication mechanism that is bypassing the password, not SSH per se ;) – marcelm Oct 12 '18 at 19:13
1

@marcelm you are right. Updated the answer... – Ravexina Oct 12 '18 at 20:07
Well, that's some sorry naming... – jpmc26 Oct 13 '18 at 04:43

score 2 · Answer 2 · answered Oct 12 '18 at 19:07

2

Because ssh keys don't care about passwords you need the account to die instead.

The old wisdom was change the user's shell to /bin/false; however this doesn't actually work.

answered Oct 12 '18 at 19:07

Joshua

709
3
8

"change the user's shell to /bin/false; however this doesn't actually work"[citation needed] – flaviut Oct 13 '18 at 00:25
3

@user60561 some ssh commands don't use the shell, like forward ports. – Joshua Oct 13 '18 at 01:00

Why should we expire a locked account to totally prevent access?

2 Answers2