Lesson 4.40: Offboarding an account safely
When someone leaves, their access must end the same day, but their data and the jobs they ran may still matter. Deleting the account at once is fast and wrong: it destroys evidence and breaks whatever depended on it. Locking only the password is also wrong: SSH keys, cron jobs and running processes keep working. A safe offboarding blocks every way in, stops what is running, keeps a copy of the data and removes privileges; deletion comes later, after the retention period. In the lab you offboard a contractor whose contract ended today.
15 min
You will learn to
- List every way an account can still act
- Lock the password and the login shell
- Disable SSH keys
- Stop cron jobs and processes
- Archive data and remove group privileges
Key terms
- Locked password
- A '!' before the hash in /etc/shadow: no password matches.
- nologin shell
- A shell that prints a message and exits, refusing interactive sessions.
- Account expiry
- A date after which the account can't be used at all.
- authorized_keys
- The list of public keys allowed to log in as a user.
- Retention period
- How long data must be kept before deletion, set by policy or law.
← More ways to look at text: head, tail, wc, sort and uniq · All lessons · SSH certificates instead of authorized_keys →