Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to temporarily modify /etc/passwd and/or /etc/group to "remove" a user/group without deleting the line.

Is there a way to do that?

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1161913 seems to indicate it may not be supported (but may also be HPUX-specific).

share|improve this question
    
Fully delete, or is it enough to disable? –  andol Jul 20 '10 at 13:34
    
@andol - I want to 'delete' using something like a comment perhaps –  warren Jul 20 '10 at 15:22

4 Answers 4

to temporarily lock a user's account you can do passwd -l username which simply adds a '!' to the beginning of the password hash in /etc/shadow, preserving the user's password, and preventing them from being able to log in with any password.

share|improve this answer
    
is there an analog for /etc/group? –  warren Jul 20 '10 at 17:45
    
you can use addgroup user group and delgroup user group –  cpbills Jul 21 '10 at 19:30
    
I don't want to delete the group permanently, nor make all the changes to group memberships post-re-enabling –  warren Jul 28 '10 at 1:41
    
why does it matter which groups they belong to, while their account is locked? there is not an option for 'locking' a user from a group, there's no data to retain, so it's just a matter of removing them from the group or adding them to the group. or leaving them be, because without being able to log in, it doesn't matter what their group membership is. –  cpbills Jul 28 '10 at 16:26
    
@cpbills - I'm looking for a way to temporarily disable a group as well, and doing a full delete would remove all the memberships, requiring them to be recreated when the group is re-enabled (or, in this case, recreated), would it not? –  warren Aug 3 '10 at 20:48

If you are just disabling the account you could change their shell to /sbin/nologin. For example, in /etc/passwd:

username:x:500:500:Firstname Lastname:/home/username:/sbin/nologin
share|improve this answer
up vote 1 down vote accepted

From everything I have tried, there seems to be no way of doing what I am describing, so I'm going to mark this answer as the accepted one.

The only way to 'temporarily' disable a group is to cp /etc/groups <path/to/backup>, make the change in /etc/groups, and revert the change later if/when needed.

share|improve this answer

Make a backup of /etc/passwd

cp /etc/passwd /etc/passwd.bak

Delete the user from the original, the backup will still have the user.

Make a script that deletes /etc/passwd and renames /etc/passwd.bak to /etc/passwd.

Set up the script in cron to do it automatically whenever you want it to run.

share|improve this answer
    
that's what I'm currently doing. I'm looking for a way of doing this without backing-up the file and making a destructive change –  warren Jul 20 '10 at 15:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.