>

Lock (and unlock) a user's password with `usermod -L`

For leaving an employee or pausing an account, `usermod -L` disables password logins in one flag — but it does not stop SSH keys, a subtlety people forget.

Linuxdisable-userusermodpasswdaccountMedium risk
Run `sudo usermod -L username` to lock the password and `sudo usermod -U username` to unlock it again.

01Command

Command
$ sudo usermod -L username

02What it does

`-L` puts a `!` in front of the hashed password in /etc/shadow, so every password check fails while the account itself, files and UID stay intact — no delete/recreate needed. The forgotten caveat from the man page itself: SSH public-key authentication is unaffected, so a fully disabled user also needs an expired shell (`usermod -s /usr/sbin/nologin username`) or an expired date (`usermod -e 1 username`). `passwd -l` does the same as `-L`, but unlocking it (`passwd -u`) fails for accounts with no password.

03Risk

RiskMedium risk
RequirementsRequires root; usermod is part of the shadow package, preinstalled on all Linux distros
!Warning: Locking the password does not terminate running sessions or block SSH keys — combine with `usermod -s /usr/sbin/nologin` for a full lockout.

04Undo

Undo
$ sudo usermod -U username

05Sources

  • usermod(8) — modify a user account
    man7.org · technical · 2026-09-17
    Evidence: Documents -L (prepend ! to encrypted password, disabling it) and -U (unlock); notes SSH key auth may still allow login

Last verified: 2026-09-17 · Category: Security & Privacy