Linux – Log out a user and delete the account

accountslinuxusers

I am having a problem on the server (CentOS 6, Plesk 11.5) where a particular user is using a mass mailer and is blacklisting our IP address. I have tried to delete this user using:

/usr/sbin/userdel test

but it returns a message saying that the user is currently logged in. I thought ok, kill the process. So I tried:

pkill -u test

and also locked the account using:

passwd -l test

which will hopefully stop him logging into the system in future.

Still saying user is logged in. How can I log this user out to enable me to delete him off the system?

Best Answer

First grep all the 'test' user's process and kill -9 all pid's then delete the user.

pgrep -u test
ps -fp $(pgrep -u test)
killall -KILL -u test
userdel -r test

Related Solutions

How to find out out WHEN an user account was locked

Currently, yes and no. The security system itself doesn't log historic details of password changes. Since it's a flat file it would be hard for such a record to be accurate and trustworthy, if access to the databases had to exclusive go through some kind of a broker then it would be possible (you could just add the logic to the broker), but with widely accessible flat files, not so much. This is why a lot of LDAP/Kerberos identity services allow this type of auditing but local unix users have a hard time with it.

The closest you can get is to enable operating system audit logging, log all command executions (with command line options) and watch the /etc/passwd and /etc/shadow files. If you can trace the change to being in a certain time period search for in the OS audit records, you might be able to trace it back to a "passwd -l" invocation or someone manually editing /etc/shadow or /etc/passwd (in case of unshadowed password).

EDIT:

To clarify, the default passwd utility on some versions of traditional UNIX (Like Solaris 9, I'm seeing) will syslog the "passwd -l" but I assumed we were on Linux given the GNU version of passwd and that that's still insufficiently complete to be trustworthy.

Ubuntu – How to control the time that users spend on

`w U1` - login informations for example for user U1 you can see in output something like this
User     tty           login@  idle   JCPU   PCPU  what

also you can make a bash script and put in crontab for example to be run a few times per one day, with varibles w U1, w U2, w U3 and make some otput into file also

`/var/run/utmp` - List of current login sessions.


 `/var/log/wtmp` - List of previous login sessions
`/var/log/btmp` - List all the bad login attempt

Best Answer

Related Solutions

How to find out out WHEN an user account was locked

Ubuntu – How to control the time that users spend on

Related Question