I have a bit of an edge case here. My institution has a RHEL server where students can log in and do their work. Accounts are held in LDAP and the server uses PAM and LDAP to authenticate. At the end of the academic year I need to lock the student accounts on this server - i.e. preserve them intact, but prevent that user from logging in. I've tried
passwd -l and
usermod -L, but in both cases the user can still log in.
Is there a way of locking an account that will work with PAM LDAP?