Now let's cover the last piece of this puzzle which is how to disable or how to lock an account without
actually deleting it.
Let's say you have someone who's going on an extended vacation or taking a leave of absence.
You want them to use their account when they get back.
But you also know that for every account that exist on a system there is a chance that someone can break
into that account since this person is going to be away for a long time.
No one may actually notice if the account is being used by someone who should not have access to it.
So let's say you decide to go ahead and lock that account for security reasons.
The best way to do this is to actually use the S.H. AGC command or change or change age.
Actually you can think of it as the change age command.
So let's look at the man page for this command page down here till we get to the dash capital E option
and that's the option to expire an account.
Here it says you can specify either a date or the number of days since January 1st 1970.
It also says to unexpired the account use negative 1 or Dash 1 or hyphen 1 or the argument to the dash
capital E options.
So let's go ahead and try this out.
So we have a user on the system called was this user has a you idea of 1008 if we change to this user
Let's see if it's working here.
Sure enough it is I created it with a password of past 2:59 in my particular system and may not be that
on your system just something to keep in mind.
Type exit here.
Now back to the vagrant user.
So let's expire this account.
Now let's try to switch to the camp.
And sure enough it says hey your account is expired.
Please contact your system administrator.
So as we learned from the man page we can actually unlock this account with dash dash 1 So what do you
say to change the age of the expiration to negative 1 on the account of ys.
Now let's see if we can log into this account and sure enough we can and there's been one failed log
in attempts since we logged in while the account was locked.
Let's get back out and go back to a vagrant user some older methods of locking account include using
the dash option to pass or something like this.
So password ESHO was and then it says hey I've lost the account and then to unlock it you would use
Piazza's to budy you against the counter name in and sure enough it says hey we've unlocked that user
and you're good to go now.
Locking in account with a password command like this does not prevent a user authenticating with an
S-sh key.
It's very important to know especially since as more and more we're using S-sh keys as our primary method
of authentication.
So if you're using S-sh keys at all this is not going to do what you think it's going to do.
So don't do it.
Use S.H. AGP instead.
Another method is to set the shell to something that is actually not a shell or something that simply
exits to look at the available shells on a system you can look at the sea shells fall into that cat
at sea shells and all see here Espin no log in user has been log and those would in theory prevent someone
from logging in.
So let's do then we'll set the shell of the WAAS user to be no log in with the user maade command dash
S is to specify the shell will give it no log in and we'll set that to was.
I think I've covered enough in this lessness I'm not going to take another diversion and cover the user
mode command.
So if you want to learn more about how to change all the settings for an existing account simply read
the user maade man page.
At first glance you think that this might actually work because if you S-sh in and you have no log in
that is your shell.
You'll get immediately logged out of the system.
It does work for interactive log like I just described but you can still do some things with S-sh that
don't require an interactive log in or don't require a shell such as port forwarding.
So again use the S.H. age command where the dash capital-T has zero option to actually disable the account.
We spent a lot of time here at the command line today so are fun let's write a quick shell script that
deletes a user account using some of what we've seen today.
So let's go ahead and go into our shared folder of Ford slash vagrant.
I'm going to call this particular scrap l user Dymo 12. SH
goes without saying we need a bang.
Let's give this a description
since we're doing some system administrator type stuff.
We want to make sure the user is executing the script with root privileges.
We already know how to do this check
if the user ID is not equal to zero.
That means they are not the root account.
So let's give them a little message here.
Let's right that that's standard air and exit one OK let's just assume which is on to get the word by
the way assume the first argument is the user to delete.
Well keep this script simple here just for demonstration purposes.
So we're just going to use a variable to represent the user will call that user sign that dollar sign
one by the way you could use Dallas and one throughout the script that would be acceptable.
I just like to have a descriptive variable name.
So now let's go ahead and delete the user
and let's make sure the user actually got deleted.
When we can do that by checking the return code or exit status of these Adell command and if it's anything
but zero we know it's bad news.
So if we get past this if statement that means the user del command succeeded and that means we can
tell the user that the account was actually deleted
we can tell them which account was deleted which they specified.
And then if we make it to the end of the script we exit with an exit status is zero because we've had
a normal completion came in or on chmod here and make sure this is executable and then let's execute
it with root privileges and let's delete a user actually let's look at the last user and that's the
password file on this particular system.
It is more.
So let's see this delete the account called more.
It says the account more was deleted.
We checked.
Sure enough it's not there.
Let's do something interesting like tried to delete an account that doesn't exist.
Hayes's user Dell user Jason does not exist.
That's actually an error message from the user Dell command.
And then our error message is displayed.
The account Jason was not deleted and that's because we checked for the exit status.
These are now command OK let's wrap this up.
And this particular lesson you learn how to delete an account using the user Dell command.
If you want to remove the user's home directory use the dash or option to the user del command to find
files on a system use to find locate or ls commands to create an archive of files.
Use the tar command.