How do I review an old Linux account before removing its access?
Account retirement should consider SSH keys, active sessions, scheduled jobs, service ownership and directory-service access. Locking a password does not necessarily stop SSH public-key authentication or terminate existing processes. Begin with evidence and choose an approved access-revocation plan rather than deleting an account and its data immediately.
Before you start
- Administrative authority to review the named account and its scheduled work.
Instructions
1. Inspect account status and running work
An authorised administrator can check the account’s password state and active processes without displaying the password hash. Review automation and business ownership before taking action.
sudo passwd -S adminuser
ps -u adminuser -o pid,ppid,lstart,commThe status code describes password state. The process listing helps locate work that may need reassignment; it does not itself revoke access.
2. Review sessions and job responsibility
Check interactive sessions and the user’s scheduled jobs. Treat crontab output as sensitive because poorly designed jobs may contain credentials.
who
sudo crontab -u adminuser -lA missing crontab is a possible normal result. Service units, external schedulers and SSH keys also require review outside this one listing.
Check the result
- The revocation plan identifies all authentication routes and live responsibilities, then verifies that the retired identity cannot establish new access while required services remain healthy.
Troubleshooting
- The password is locked but SSH still works
- Public-key or other authentication may remain enabled. Revoke the approved identity routes and existing sessions according to policy, without deleting shared application data.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.