Lock an authd user¶

Locking a user stops them from logging in through authd, but keeps their local account intact.

Locking and unlocking users can be done using authd’s authctl tool.

When to lock a user¶

Lock a user instead of deleting them when you want to:

Suspend access temporarily and restore it later.
Keep the user’s UID and GID reserved, so that authd cannot assign them to another user while the first user’s files are still on the system. See UID and GID conflicts.

Run this on each host where the user has logged in:

sudo authctl user lock alice@example.com

Locking does not end sessions that are already running. To log the user out of the host:

sudo loginctl terminate-user alice@example.com

The lock stays in effect if the user is renamed in the identity provider, because authd also matches the record by the provider’s user ID.

SSH access from locked users

SSH public-key authentication does not involve authd.

This means that a locked user can still log in with an SSH key. See SSH public key authentication for more details.

To unlock a locked user, run:

sudo authctl user unlock alice@example.com