How to deactivate a login

[mm8294]

We need disable some user accounts. I know we can open SAM and deactivate user accounts, but there are hundreds of them and it takes too long. My boss said it can be done with 'usermod' and asked me to write a script to do it. However, I checked the man page of usermod and I don't think it can do it.

Does anybody know how to disable/deactivate user accounts with command line?


Thanks in advance.

 

[mm8294]

I got it: you can user either 'passwd -l username' or 'usermod -e 6/14/06 username' to do it.


But, now the question is: how do enable those accounts through command?

 

[KenCunningham]

I guess to enable them again you could just set the -e date parameter to a date later than the day you're issuing the command. You may have to reset the password at the same time.

I take it you're OK with the script to disable these accounts en-masse?

 

[mm8294]

KenCuningham,

'usermod -e' should work if the accounts were disabled with the same command. If they were disabled with 'passwd -l', it won't.

Thank you very much.

 

[daFranze]

as Ken wrote: using 'passwd -l username' you can not enable the user, since the encrypted password is replaced by a n asterisk in /etc/passwd

If you have converted your system into a secure system you could use getprpw and modprpw to check and set user attributes

Best Regards, Franz
--
UNIX System Manager from Munich, Germany

 

[mm8294]

daFranze,

It's interesting: on hour system, the password for every account in /etc/passwd is '*'

 

[KenCunningham]

The encrypted password is held in /etc/shadow rather than /etc/passwd

 

[daFranze]

this is depending on how you set up the host: you could use default UNIX behavour, password is encrypted and saved in /etc/passwd file; for higher security it is crypted and stored in /etc/shadow, and for paranoids ;-) hp offers the /tcb Structures
if you have the standard UNIX version a locked user has an undecryptable password like an asterisk

I currently participate in a hp Training in BadHomburg Germany and the passwd file looks like this:

root@bhg168   [/root]
# head -5 /etc/passwd
root:9oTPronwCKT9w:0:3::/root:/sbin/sh
instr:5iIpsxhIAieBA:0:3:INSTRUCTOR USE ONLY:/home/instr:/sbin/sh
daemon:*:1:5::/:/sbin/sh
bin:*:2:2::/usr/bin:/sbin/sh
sys:*:3:3::/:

daemon, bin, sys are locked users

Best Regards, Franz
--
UNIX System Manager from Munich, Germany