How to Lock a User Account in Linux using the passwd Command

The Immediate Security Threat

In a corporate environment, employee terminations or security breaches happen rapidly. If an employee is fired, or if an intrusion detection system flags an account as compromised, the system administrator cannot afford to wait for a change-management ticket to be approved before taking action. The account must be neutralized instantly to prevent data exfiltration or malicious commands.

While you could completely delete the user’s account using the userdel command, this is highly discouraged during an active incident. Deleting the account also strips the ownership metadata from all their files, complicating forensic investigations and data recovery.

Instead, the best practice is to simply lock the account. Locking an account mathematically invalidates the password, making it impossible for anyone (including the original owner) to log in via SSH or the local console, while leaving all their files and configurations perfectly intact.

Locking the Account

The standard Linux passwd command (which is normally used to change passwords) contains a powerful administrative flag specifically for this purpose.

You must execute this command as the root user or via sudo. To lock a user account named jsmith, run the following:

sudo passwd -l jsmith

The -l (lock) flag executes instantly. The terminal will output a simple confirmation: passwd: password expiry information changed.

How it Works

Linux stores encrypted password hashes in the /etc/shadow file. When you issue the lock command, the system does not actually delete the user’s password. Instead, it prepends an exclamation mark (!) to the beginning of their encrypted hash.

Because no valid hashing algorithm can ever result in a hash starting with an exclamation mark, the login daemon (PAM) will automatically reject every single password attempt, effectively locking the account.

Verifying the Lock Status

To verify that the account is truly secured, use the -S (status) flag:

sudo passwd -S jsmith

The output will look something like this:

jsmith L 08/24/2026 0 99999 7 -1

The critical information is the second column. If the account is locked, it will display an L (Locked). If it is active, it will display a P (Password set).

Unlocking the Account

If the security incident was a false alarm, or if the employee is reinstated, you can instantly restore their access without forcing them to create a new password.

Use the -u (unlock) flag:

sudo passwd -u jsmith

This command simply removes the exclamation mark from the /etc/shadow file, restoring the original hash. The user can immediately log in using their previous, known password.

A Critical Warning Regarding SSH Keys

The passwd -l command only locks password-based logins. It does not disable the account entirely.

If the user has set up SSH Key-Based Authentication (where they log in using a private certificate rather than a typed password), they can still log in even if the account is locked. The SSH daemon (sshd) verifies the cryptographic key before it even checks the /etc/shadow password file.

To completely secure an account, you must run passwd -l and manually edit their ~/.ssh/authorized_keys file (or move it) to invalidate any active SSH certificates.