Lock Password Authentication

The assistant temporarily should not authenticate with their password. usermod -L can lock the stored password credential without deleting the account or its files. That is a specific operation, even though people sometimes casually call it 'locking the account.'

Let's be precise about the limit. Other configured authentication methods may remain usable, and existing sessions are not automatically terminated. If your goal is complete access revocation, password locking is only one part of the plan.

Prepare the example

Use the practice VM and a disposable account you can recover administratively. Verify the username before changing it; never use your only administrative login as the experiment. You need authorization to update another user's password record.

Bash · Linux terminal

sudo usermod -L school-assistant
sudo passwd -S school-assistant

Expected behavior; machine-dependent details

Status commonly indicates a locked password; output format varies.

usermod -L school-assistant applies the password lock mechanism. passwd -S school-assistant then reports password status using the installed tool's format. Look for the documented lock indication rather than expect the exact output shown on another distribution.

Now ask a broader question: could this person still enter using an authorized SSH key, or continue using a shell they already started? Those are separate paths. Account expiration, key configuration, sessions and services need their own review. A locked password and a deleted account also leave different resources behind, so do not treat the two operations as equivalent.

Locking an account is useful when you need to suspend password-based login without deleting the user and its files.

Why Lock a User Account?

Locking a password credential restricts password authentication, but may leave key-based or other access available, but it does not delete their files, processes, or home directory. This is useful when you want to temporarily restrict access without permanently removing the account.

Step-by-Step: Locking the Account

Let’s say you want to lock a user named john. Here’s how you do it using the terminal:

sudo usermod -L john

This command locks the password of the user account. The user won’t be able to log in using their password anymore.

What Actually Happens?

When you lock the account, Linux adds an exclamation mark (!) in front of the user’s password hash in the /etc/shadow file.

You can verify this using:

sudo grep '^john:' /etc/shadow

john:!$6$somerandomhashhere:19373:0:99999:7:::

See that ! before the hash? That means the account is locked.

Alternative Method (Using passwd)

You can also lock a user account with the passwd command:

sudo passwd -l john

It works the same way — just a different tool under the hood.

How to Unlock the Account

To reverse it and allow the user to log in again:

sudo usermod -U john

or

sudo passwd -u john

Understand what account locking changes

• Use usermod -L or passwd -l to lock a user account
• This disables password-based login for the user
• Unlock with usermod -U or passwd -u

And that’s it! You now know how to lock and unlock user accounts on Linux. Handy, right? Whether you’re managing a home server or a production environment, this skill is a must-have in your Linux toolkit. Keep exploring, and happy learning!

Suppose the requirement is stronger than a temporary password lock: the assistant must no longer access a shared server. Begin by listing the ways that identity can act. A password, an SSH key, a running session and a service started earlier are different parts of the situation. The password lock changes one credential; it does not necessarily remove the others.

Choose the revocation measures that match the actual system and required timing. Account expiration, key management and session or service handling can each need separate authorized action. Then verify the relevant access paths. This is why we describe usermod -L precisely as password locking instead of promise that it is a universal account-disable procedure.

Your task: Does password locking guarantee all authentication paths are disabled?

Use the practice VM and a disposable account you can recover administratively. Verify the username before changing it; never use your only administrative login as the experiment. You need authorization to update another user's password record.

Bash · complete example for this question

sudo usermod -L school-assistant
sudo passwd -S school-assistant

Expected behavior; machine-dependent details

Status commonly indicates a locked password; output format varies.

Worked answer

No; it locks the password credential, not necessarily keys and sessions.

Password locking does not guarantee all access paths are disabled. It targets the password credential. The answer should therefore mention keys and existing sessions rather than claiming the command removed every resource associated with the account.

Name the access path you are restricting. Verify the password status, then examine additional credentials and sessions if revocation is the real goal. Precise language helps here: 'password locked' tells you more than the vague claim that all account access is gone.