Why should we expire a locked account to totally prevent access?

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
5
down vote

favorite












From man usermod:




Note: if you wish to lock the account (not only access with a
password), you should also set the EXPIRE_DATE to 1.




  • Why should we expire a locked account to totally prevent access to the account?

  • What will happen if I do not expire a locked account?





users accounts usermod







share|improve this question



























    up vote
    5
    down vote

    favorite












    From man usermod:




    Note: if you wish to lock the account (not only access with a
    password), you should also set the EXPIRE_DATE to 1.




    • Why should we expire a locked account to totally prevent access to the account?

    • What will happen if I do not expire a locked account?





    users accounts usermod







    share|improve this question

























      up vote
      5
      down vote

      favorite









      up vote
      5
      down vote

      favorite











      From man usermod:




      Note: if you wish to lock the account (not only access with a
      password), you should also set the EXPIRE_DATE to 1.




      • Why should we expire a locked account to totally prevent access to the account?

      • What will happen if I do not expire a locked account?





      users accounts usermod







      share|improve this question















      From man usermod:




      Note: if you wish to lock the account (not only access with a
      password), you should also set the EXPIRE_DATE to 1.




      • Why should we expire a locked account to totally prevent access to the account?

      • What will happen if I do not expire a locked account?





      users accounts usermod




      users accounts usermod






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited 15 mins ago









      Tim

      19k1482134




      19k1482134










      asked 12 hours ago









      Sinoosh

      7741619




      7741619




















          2 Answers
          2






          active

          oldest

          votes

















          up vote
          9
          down vote



          accepted










          usermod -L actually only locks the user's password, so user still is able to login using other methods for example an ssh session which uses public key authentication.



          But if you set the EXPIRE_DATE to 1 the account will be expired entirely and the user is not able to use it in any way. This is because 1 is equal to it expiring at1970-01-01 00:00:01.






          share|improve this answer






















          • How about usermod -L -e 300 username ? The account will be expired entirely?
            – Sinoosh
            9 hours ago






          • 1




            @Sinoosh it's somehow the same. the expire date would be set at Oct 28, 1970 which makes account expired.
            – Ravexina
            9 hours ago










          • Thank you, could you tell me how can i login to a locked account by ssh ?
            – Sinoosh
            9 hours ago






          • 1




            Read these: How to create multiple ssh keys?, How do I set up SSH authentication keys? and How can I set up password-less SSH login?.
            – Ravexina
            9 hours ago







          • 1




            @Ravexina It would be better if you actually called it "SSH public key authentication" in your answer, because it's the authentication mechanism that is bypassing the password, not SSH per se ;)
            – marcelm
            8 hours ago

















          up vote
          1
          down vote













          Because ssh keys don't care about passwords you need the account to die instead.



          The old wisdom was change the user's shell to /bin/false; however this doesn't actually work.






          share|improve this answer




















          • "change the user's shell to /bin/false; however this doesn't actually work"[citation needed]
            – user60561
            3 hours ago







          • 1




            @user60561 some ssh commands don't use the shell, like forward ports.
            – Joshua
            2 hours ago










          Your Answer







          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "89"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          convertImagesToLinks: true,
          noModals: false,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













           

          draft saved


          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1083252%2fwhy-should-we-expire-a-locked-account-to-totally-prevent-access%23new-answer', 'question_page');

          );

          Post as a guest

















          2 Answers
          2






          active

          oldest

          votes








          2 Answers
          2






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes








          up vote
          9
          down vote



          accepted










          usermod -L actually only locks the user's password, so user still is able to login using other methods for example an ssh session which uses public key authentication.



          But if you set the EXPIRE_DATE to 1 the account will be expired entirely and the user is not able to use it in any way. This is because 1 is equal to it expiring at1970-01-01 00:00:01.






          share|improve this answer






















          • How about usermod -L -e 300 username ? The account will be expired entirely?
            – Sinoosh
            9 hours ago






          • 1




            @Sinoosh it's somehow the same. the expire date would be set at Oct 28, 1970 which makes account expired.
            – Ravexina
            9 hours ago










          • Thank you, could you tell me how can i login to a locked account by ssh ?
            – Sinoosh
            9 hours ago






          • 1




            Read these: How to create multiple ssh keys?, How do I set up SSH authentication keys? and How can I set up password-less SSH login?.
            – Ravexina
            9 hours ago







          • 1




            @Ravexina It would be better if you actually called it "SSH public key authentication" in your answer, because it's the authentication mechanism that is bypassing the password, not SSH per se ;)
            – marcelm
            8 hours ago














          up vote
          9
          down vote



          accepted










          usermod -L actually only locks the user's password, so user still is able to login using other methods for example an ssh session which uses public key authentication.



          But if you set the EXPIRE_DATE to 1 the account will be expired entirely and the user is not able to use it in any way. This is because 1 is equal to it expiring at1970-01-01 00:00:01.






          share|improve this answer






















          • How about usermod -L -e 300 username ? The account will be expired entirely?
            – Sinoosh
            9 hours ago






          • 1




            @Sinoosh it's somehow the same. the expire date would be set at Oct 28, 1970 which makes account expired.
            – Ravexina
            9 hours ago










          • Thank you, could you tell me how can i login to a locked account by ssh ?
            – Sinoosh
            9 hours ago






          • 1




            Read these: How to create multiple ssh keys?, How do I set up SSH authentication keys? and How can I set up password-less SSH login?.
            – Ravexina
            9 hours ago







          • 1




            @Ravexina It would be better if you actually called it "SSH public key authentication" in your answer, because it's the authentication mechanism that is bypassing the password, not SSH per se ;)
            – marcelm
            8 hours ago












          up vote
          9
          down vote



          accepted







          up vote
          9
          down vote



          accepted






          usermod -L actually only locks the user's password, so user still is able to login using other methods for example an ssh session which uses public key authentication.



          But if you set the EXPIRE_DATE to 1 the account will be expired entirely and the user is not able to use it in any way. This is because 1 is equal to it expiring at1970-01-01 00:00:01.






          share|improve this answer














          usermod -L actually only locks the user's password, so user still is able to login using other methods for example an ssh session which uses public key authentication.



          But if you set the EXPIRE_DATE to 1 the account will be expired entirely and the user is not able to use it in any way. This is because 1 is equal to it expiring at1970-01-01 00:00:01.







          share|improve this answer














          share|improve this answer



          share|improve this answer








          edited 13 mins ago









          Tim

          19k1482134




          19k1482134










          answered 10 hours ago









          Ravexina

          29.5k147199




          29.5k147199











          • How about usermod -L -e 300 username ? The account will be expired entirely?
            – Sinoosh
            9 hours ago






          • 1




            @Sinoosh it's somehow the same. the expire date would be set at Oct 28, 1970 which makes account expired.
            – Ravexina
            9 hours ago










          • Thank you, could you tell me how can i login to a locked account by ssh ?
            – Sinoosh
            9 hours ago






          • 1




            Read these: How to create multiple ssh keys?, How do I set up SSH authentication keys? and How can I set up password-less SSH login?.
            – Ravexina
            9 hours ago







          • 1




            @Ravexina It would be better if you actually called it "SSH public key authentication" in your answer, because it's the authentication mechanism that is bypassing the password, not SSH per se ;)
            – marcelm
            8 hours ago
















          • How about usermod -L -e 300 username ? The account will be expired entirely?
            – Sinoosh
            9 hours ago






          • 1




            @Sinoosh it's somehow the same. the expire date would be set at Oct 28, 1970 which makes account expired.
            – Ravexina
            9 hours ago










          • Thank you, could you tell me how can i login to a locked account by ssh ?
            – Sinoosh
            9 hours ago






          • 1




            Read these: How to create multiple ssh keys?, How do I set up SSH authentication keys? and How can I set up password-less SSH login?.
            – Ravexina
            9 hours ago







          • 1




            @Ravexina It would be better if you actually called it "SSH public key authentication" in your answer, because it's the authentication mechanism that is bypassing the password, not SSH per se ;)
            – marcelm
            8 hours ago















          How about usermod -L -e 300 username ? The account will be expired entirely?
          – Sinoosh
          9 hours ago




          How about usermod -L -e 300 username ? The account will be expired entirely?
          – Sinoosh
          9 hours ago




          1




          1




          @Sinoosh it's somehow the same. the expire date would be set at Oct 28, 1970 which makes account expired.
          – Ravexina
          9 hours ago




          @Sinoosh it's somehow the same. the expire date would be set at Oct 28, 1970 which makes account expired.
          – Ravexina
          9 hours ago












          Thank you, could you tell me how can i login to a locked account by ssh ?
          – Sinoosh
          9 hours ago




          Thank you, could you tell me how can i login to a locked account by ssh ?
          – Sinoosh
          9 hours ago




          1




          1




          Read these: How to create multiple ssh keys?, How do I set up SSH authentication keys? and How can I set up password-less SSH login?.
          – Ravexina
          9 hours ago





          Read these: How to create multiple ssh keys?, How do I set up SSH authentication keys? and How can I set up password-less SSH login?.
          – Ravexina
          9 hours ago





          1




          1




          @Ravexina It would be better if you actually called it "SSH public key authentication" in your answer, because it's the authentication mechanism that is bypassing the password, not SSH per se ;)
          – marcelm
          8 hours ago




          @Ravexina It would be better if you actually called it "SSH public key authentication" in your answer, because it's the authentication mechanism that is bypassing the password, not SSH per se ;)
          – marcelm
          8 hours ago












          up vote
          1
          down vote













          Because ssh keys don't care about passwords you need the account to die instead.



          The old wisdom was change the user's shell to /bin/false; however this doesn't actually work.






          share|improve this answer




















          • "change the user's shell to /bin/false; however this doesn't actually work"[citation needed]
            – user60561
            3 hours ago







          • 1




            @user60561 some ssh commands don't use the shell, like forward ports.
            – Joshua
            2 hours ago














          up vote
          1
          down vote













          Because ssh keys don't care about passwords you need the account to die instead.



          The old wisdom was change the user's shell to /bin/false; however this doesn't actually work.






          share|improve this answer




















          • "change the user's shell to /bin/false; however this doesn't actually work"[citation needed]
            – user60561
            3 hours ago







          • 1




            @user60561 some ssh commands don't use the shell, like forward ports.
            – Joshua
            2 hours ago












          up vote
          1
          down vote










          up vote
          1
          down vote









          Because ssh keys don't care about passwords you need the account to die instead.



          The old wisdom was change the user's shell to /bin/false; however this doesn't actually work.






          share|improve this answer












          Because ssh keys don't care about passwords you need the account to die instead.



          The old wisdom was change the user's shell to /bin/false; however this doesn't actually work.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered 8 hours ago









          Joshua

          29114




          29114











          • "change the user's shell to /bin/false; however this doesn't actually work"[citation needed]
            – user60561
            3 hours ago







          • 1




            @user60561 some ssh commands don't use the shell, like forward ports.
            – Joshua
            2 hours ago
















          • "change the user's shell to /bin/false; however this doesn't actually work"[citation needed]
            – user60561
            3 hours ago







          • 1




            @user60561 some ssh commands don't use the shell, like forward ports.
            – Joshua
            2 hours ago















          "change the user's shell to /bin/false; however this doesn't actually work"[citation needed]
          – user60561
          3 hours ago





          "change the user's shell to /bin/false; however this doesn't actually work"[citation needed]
          – user60561
          3 hours ago





          1




          1




          @user60561 some ssh commands don't use the shell, like forward ports.
          – Joshua
          2 hours ago




          @user60561 some ssh commands don't use the shell, like forward ports.
          – Joshua
          2 hours ago

















           

          draft saved


          draft discarded















































           


          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1083252%2fwhy-should-we-expire-a-locked-account-to-totally-prevent-access%23new-answer', 'question_page');

          );

          Post as a guest
































































          -

          Popular posts from this blog

          How to check contact read email or not when send email to Individual?

          Image
          Clash Royale CLAN TAG #URR8PPP up vote 1 down vote favorite I'm using WordPress 4.9.8, CiviCRM to 5.5.1, I usually send email to contact by Search> Find contacts View contact details Action> Send email Send email ok, Contact received mail ok like picture But status only Email sent though contact read email or not. So, can CiviCRM can change status to Email read when contact read email? wordpress email share | improve this question asked Sep 26 at 0:12 ToanLuong 49 9 add a comment  |  up vote 1 down vote favorite I'm using WordPress 4.9.8, CiviCRM to 5.5.1, I usually send email to contact by Search> Find contacts View contact details Action> Send email Send email ok, Contact received mail ok like picture But status only Email sent though contact read email or not. So, can CiviCRM can change status to Email read when contact read email? wordpress email share | improve this questi...
          Read more

          Displaying single band from multi-band raster using QGIS

          Image
          Clash Royale CLAN TAG #URR8PPP 1 How can I extract a single band from multi-band raster in QGIS? I have an remote sensed image which has 6 bands (including NDVI band), I want to display each band separately, but have no idea how to do. I have seen some questions similar here but none worked for me. The original image (has 6 bands) is: I want to display the band 6 which should be like this: But I tried gdal_translate, and couldn't get the correct result. What I have got is: qgis raster multi-band share | improve this question edited Mar 5 at 0:53 Summer asked Mar 4 at 6:42 Summer Summer 23 6 Is this any help gis.stackexchange.com/questions/220658/… ? if not gis.stackexchange.com/questions/62133/… might help. – Michael Stimson Mar 4 at 6:46 Thanks for answering but when I used gdal_translate, qgis showed that 'Error 4: Kayena.tif: No such file or directory". Would you know how to fi...
          Read more

          How many registers does an x86_64 CPU actually have?

          Image
          Clash Royale CLAN TAG #URR8PPP up vote 2 down vote favorite I am currently learning reverse engineering and am studying the flags register. I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx . But it looks like rflags is actually an additional register. So that makes 17 registers in total... how many more could there be? I have spent at least an hour on this and found numerous different answers. The best answer so far is this, which says that there are 40 registers in total. 16 General Purpose Registers 2 Status Registers 6 Code Segment Registers 16 SSE Registers 8 FPU/MMX Registers But if I add that up, I get 48. Could anybody provide an official answer on how many registers an x86_64 CPU has (e.g. an Intel i7). Additionally, I have seen references to 'hardware' and 'architectural' registers. What are those registers and how many are there? register x86-64 share | improve this...
          Read more