Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a simple question for you, well, at least, much simpler than "How do I clean up a compromised user account?" The question is: "How do I disable a compromised user account?" There are some obvious things to do:

  • Disable logins for the user (we've done this by changing their home directory to /disabled/home/user)
  • Disable the users Apache websites (once again, but replacing with bogus paths.)
  • Killing off all the users processes using pkill -9 -u username
  • Checking they have no spooled cronjobs

So, if their processes mysteriously come back after doing these things, what did we miss?

share|improve this question

I'd also do the following:

 a. Disable the account password, via passwd -l
 b. Change the users' login shell to /bin/false
 c. Remove the users' .ssh directory
 d. Remove the users' .rhosts file
share|improve this answer
We don't have account passwords! (We use Kerberos, and don't have control of the realm.) If the users home directory was changed, does that make .ssh and .rhosts moot? – Edward Z. Yang Oct 25 '11 at 5:14

I agree with mdpc on this. I might add another suggestion, though, in addition to his recommendations. There is a method of putting limits on user processes, per user, via /etc/security/limits.conf. (I don't know if this is uniform across all distributions.) You may be able to disallow processes belonging to that user by setting the limit to 0.

This link might help you - see section 1.4 on Limits.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.