Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created some users on my Ubuntu 10.0.4 machine a long time ago (whilst experimenting). Some of these users can login to the system, and others were prevented from login in. I can't remeber which ones can login. I have the following questions:

  • How do I find out which users may login to the machine?
  • How may I disable an existing user account from login in?
  • How may I re-enable a previously (login) disabled user account so it an login again?
share|improve this question
up vote 3 down vote accepted

How about

sudo passwd -aS

man passwd tells us:

-a, --all

This option can be used only with -S and causes show status for all users.

-S, --status

Display account status information. The status information consists of 7 fields. The first field is the user´s login name. The second field indicates if the user account is locked (L), has no password (NP), or has a usable password (P). The third field gives the date of the last password change. The next four fields are the minimum age, maximum age, warning period, and inactivity period for the password. These ages are expressed in days.

And then to lock and unlock accounts we find this:

-l, --lock

Lock the password of the named account. This option disables a password by changing it to >a value which matches no possible encrypted value (it adds a ´!´ at the beginning of the >password).

Note that this does not disable the account. The user may still be able to login using >another authentication token (e.g. an SSH key). To disable the account, administrators >should use usermod --expiredate 1 (this set the account´s expire date to Jan 2, 1970).

Users with a locked password are not allowed to change their password.

-u, --unlock

Unlock the password of the named account. This option re-enables a password by changing >the password back to its previous value (to the value before using -l option, by removing the leading ´!´).

Hope this cut and paste from the man page clarifies things.

share|improve this answer
Thanks for the answer. Could you clarify this though: By 'locking' the account, this means that the user still exists on the system (i.e. can own files etc), but can no longer log into the system - right? – morpheous Aug 26 '10 at 10:44
Yes, that is true. Password is disabled, but login with ssh keys are still possible. – Johan Aug 26 '10 at 13:59

If you are using the Desktop version, just click System -> Administration -> Users and Groups. Select a user and click advanced settings, then look for 'Disable Account' checkbox on the advanced tab.

If not, you can find the information by hand - the /etc/shadow file has each user's hashed password in the second field (its colon separated). If the password field starts with ! or *, that account is locked.

You can lock and unlock with "passwd -l username" and "passwd -u username"

share|improve this answer
Are you sure that you don't mean -l/-u and not -L/-U? – Johan Aug 26 '10 at 14:00
You are correct Johan, fixed – Nathan O'Sullivan Aug 28 '10 at 0:07

passwd -L and passwd -l can be used to lock and unlock accounts.

note that this is strictly for logins, and does not prevent the user form accessing the system if using an ssh key file for authentication.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .