Disabling password login for a user in Linux

Locking a user’s password

You can disable password login for a user by locking their password. Just use the passwd command with the -l (--lock) option followed by the username:

sudo passwd -l newman

The -l option disables the password by changing it to a value that does not match any possible encrypted value. As a result, the user will not be able to log in with a password. Authentication with an SSH key keeps working. If we wanted to block logins completely, we would also have to change the user’s shell, for example like this:

sudo usermod -s /usr/sbin/nologin newman

Unlocking a user’s password

To allow password login again, simply unlock the password with the -u (--unlock) option:

sudo passwd -u newman

Checking the status of a user’s password

If we want to find out the status of a user’s password, we use the -S (--status) option:

sudo passwd -S newman

The result may then look something like this:

$ sudo passwd -S newman
newman L 06/15/2021 0 99999 7 -1

The output contains information in seven columns, with the following meaning:

1. the user’s login name,
2. whether the account is locked (L), has no password (NP) or has a usable password (P),
3. the date of the last password change,
4. the minimum number of days before the password can be changed again after the previous change,
5. the maximum number of days before the password must be changed again,
6. the number of days before password expiration during which the user starts receiving warnings,
7. the number of days after password expiration before the user is deactivated.

For this note I drew mostly on this article, which describes further options for working with user passwords.