How To Delete A User On Linux (and Remove Any Trace)

There is more to deleting a user on Linux than you think. If you are a system administrator, you should remove all traces of the account and its access from your systems. We’ll show you the steps.

If you only want to delete one user account from your system and are not concerned about ending running processes and other cleanup tasks, follow the steps in the “Deleting the User Account” section below. You will need it deluser Command on Debian -based distributions and the userdel Command on other Linux distributions.

Linux user accounts

Since the first time-sharing systems appeared in the early 1960s and introduced the ability for multiple users to work on a single computer, there was a need to isolate and divide each user’s files and data from all other users. So user accounts— and passwords -was born.

User accounts have an administrative burden. They must be created the first time the user needs access to the computer. They must be removed when this access is no longer required. In Linux, there are a number of steps that should be followed in order to correctly and methodically remove the user, their files, and their account from the computer.

If you are the system administrator, that responsibility is yours. So go ahead.

Our scenario

There are a number of reasons an account might need to be deleted. An employee can move to another team or leave the company entirely. The account may have been set up for a short-term collaboration with a visitor from another company. Team-ups are common in the academic world, where research projects can involve departments, various universities, and even commercial institutions. At the end of the project, the system administrator needs to do housekeeping and remove unnecessary accounts.

The worst-case scenario is when someone disappears under a cloud because of an offense. Such events usually happen suddenly and without warning. This gives the system administrator very little time to plan, and there is an urgent need to lock, close and delete the account – with a copy of the user’s files in case they are needed for forensics after the closure. secured.

In our scenario, let’s assume that a user, Eric, did something that justified his immediate removal from the premises. At the moment he doesn’t know about it, he is still working and has logged in. As soon as you nod to the security, he will be escorted out of the building.

Everything is set. All eyes are on you.

Check the login

Let’s see if he’s really logged in and if so, how many sessions he’s working with. the who command lists active sessions .

who

Eric is logged in once. Let’s see what processes he’s doing.

Review of the user’s processes

We can use that ps Command to lists the processes this user is running . the -u (User) option let’s say ps limit its output to the processes executing under the ownership of that user account.

                      ps -u eric

We can see the same processes with more information by looking at the top Command. top also has one -U (User) Option to limit the output to the processes owned by a single user. Notice that this time it’s a capital “U”.

                      top -U eric

We can see the memory and CPU usage of each task and quickly check for any suspicious activity. We are in the process of forcibly killing all of its processes, so it is safest to take a moment to quickly review the processes and ensure that other users will not be harassed if you terminate the user account eric ‘s processes.

It doesn’t look like he’s doing much, just with less to view a file. We can safely proceed. But before we terminate its processes, we will freeze the account by locking the password.

How to Use the ps Command to Monitor Linux Processes

Lock the account

We lock the account before we kill the processes because if we kill the processes the user will be logged out. If we have already changed his password, he will not be able to log in again.

The encrypted user passwords are saved in /etc/shadow File. You wouldn’t normally bother with these next few steps, but so that you can see what’s in the /etc/shadow If you block the account, we will make a small detour. With the following command we can look at the first two fields of the entry for the eric User account.

                      sudo awk -F: '/eric/ {print $1,$2}' /etc/shadow

The awk command parses fields from text files and optionally manipulates them. We use that -F (Field separator) option to say awk that the file uses a colon ” : “To separate the fields. We’re looking for a line with the pattern “eric”. For matching lines, we print the first and second fields. These are the account name and the encrypted password.

The entry for the user account eric will be printed for us.

To block the account we use the passwd Command. We’ll use that -l (Lock) option and Enter the name of the user account to be blocked .

                      sudo passwd -l eric

When we check /etc/passwd File one more time, we’ll see what happened.

                      sudo awk -F: '/eric/ {print $1,$2}' /etc/shadow

An exclamation mark has been added to the beginning of the encrypted password. It does not overwrite the first character, it is only added at the beginning of the password. That is all that is required to prevent a user from logging into this account.

After preventing the user from logging back in, we can kill their processes and log them off.

Killing the processes

There are several ways to kill a user’s processes, but the command shown here is widely used and a more modern implementation than some of the alternatives. the pkill Command finds and terminates processes. We give the KILL-Signal continue and use that -u (User) option.

                      sudo pkill -KILL -u eric

You return to the command prompt in a decidedly anti-climatic fashion. To make sure something happened, let’s take a look who again:

who

His session is gone. He has been logged off and his processes have stopped. That made the situation less urgent. Now we can relax a little and continue with the rest of the tidying up while security goes to Eric’s desk.

How to end processes from the Linux terminal

Archive the user’s home directory

It cannot be ruled out that such a scenario may require future access to the user’s files. Either as part of an investigation or simply because your successor may have to fall back on the work of your predecessor. We’ll use that tar command to archive your entire home directory .

The options we use are:

C. : Create an archive file.
F. : Use the specified file name for the name of the archive.
J : Use bzip2 compression.
v : Provides verbose output when the archive is being built.

                      sudo tar cfjv eric-20200820.tar.bz /home/eric

Many screen outputs are scrolled in the terminal window. To check that the archive was created, use the ls Command. We use that -l (long format) and -h (human readable) options.

                      ls -lh eric-20200802.tar.bz

A file of 722 MB was created. This can be copied to a safe place for later review.

Remove cron jobs

We’d better look if there are any cron Jobs scheduled for user account eric . A cron job is a command that is triggered at specific times or intervals. We can check if there are any cron jobs scheduled for this user account with ls :

                      sudo ls -lh /var/spool/cron/crontabs/eric

If something exists in that place, it means that it is there cron Jobs queued for this user account. With that we can delete them crontab Command. the -r (Remove) option removes the jobs and the -u (User) option says crontab whose jobs should be removed .

                      sudo crontab -r -u eric

The jobs are silently deleted. As far as we know, if Eric suspected he was about to be evicted, Eric would have planned a malicious job. This step is best practice.

Remove print jobs

Maybe the user had pending print jobs? To be on the safe side, we can delete the print queue from all jobs belonging to the user account eric . the lprm command removes jobs from the print queue . the -U The (Username) option allows you to remove jobs owned by the named user account:

                      lprm -U eric

The jobs are removed and you are returned to the command line.

Delete the user account

We already have the files from /home/eric/ Directory so we can go ahead and delete the user account and delete the /home/eric/ Directory at the same time.

The command to use depends on which Linux distribution you are using. To the Debian-based Linux distributions , the command is deluser , and for the rest of the Linux world , it is userdel .

In fact, both commands are available on Ubuntu . I half expected one to be an alias of the other, but they are different binaries.

                      type deluser

                      type userdel

Although both are available, it is recommended that you use deluser on Debian-derived distributions :

“ userdel is a low-level user removal utility. Under Debian, administrators should normally use deluser (8) instead. “

That’s clear enough so is the command to use on this Ubuntu computer deluser . Since we also want your home directory removed, we’ll use the --remove-home Flag:

                      sudo deluser --remove-home eric

The command to use for non-Debian distributions is userdel , with the --remove Flag:

                      sudo userdel --remove eric

All traces of the user account eric were deleted. We can check if the /home/eric/ Directory was removed:

                      ls /home

the eric Group was also removed because the user account eric was the only entry in it. We can easily check this by looking at the contents of the /etc/group by grep :

                      sudo less /etc/group | grep eric

It’s a wrap

Eric is gone for his sins. The security guards are still leading him out of the building and you’ve already backed up and archived his files, deleted his account and cleared the system of any remains.

Accuracy always comes before speed. Make sure you consider each step before doing it. You don’t want anyone to go to your desk and say, “No, the other Eric”.