Over time, servers accumulate user accounts — former team members, test accounts, service accounts no longer in use. Each unused account is unnecessary attack surface worth periodically auditing and cleaning up.
Why This Matters
An unused account is still a valid authentication target — if it has a weak or default password, or was created for someone no longer authorized, it represents unnecessary risk with zero legitimate ongoing benefit.
Step 1 — List All User Accounts
cat /etc/passwdReview the full list, distinguishing between system/service accounts (typically with UIDs below 1000) and actual human user accounts.
Step 2 — List Accounts That Can Actually Log In
awk -F: '($7 !~ /nologin|false/) {print $1}' /etc/passwdFilters out accounts with a shell explicitly set to nologin or false, showing only accounts that could theoretically be used for interactive login.
Step 3 — Check Last Login Time for Each Account
lastlogShows the most recent login time for each account — accounts showing "Never logged in" or a very old last-login date are candidates for review.
Step 4 — Cross-Reference Against Your Actual Current Team
For each active-seeming account, confirm it corresponds to someone who genuinely still needs access — a former employee/contractor's still-active account is a common, easily-overlooked security gap.
Step 5 — Disable (Don't Immediately Delete) Suspicious Accounts
sudo usermod -L username
sudo usermod -s /usr/sbin/nologin usernameLocking the account and disabling its shell prevents login while preserving the account and its files temporarily — useful in case you need to investigate or reference something before fully removing it.
Step 6 — Fully Remove Confirmed-Unnecessary Accounts
sudo userdel -r username-r also removes the user's home directory and mail spool — verify you don't need anything from that account's files before using this flag.
Step 7 — Audit sudo Group Membership
getent group sudoReview specifically who has sudo/administrative privileges — even more important to keep current than general account existence, given the elevated access sudo group membership grants.
Step 8 — Audit SSH Authorized Keys
for user_home in /home/*; do
echo "=== $user_home ==="
cat "$user_home/.ssh/authorized_keys" 2>/dev/null
doneReview which SSH keys are authorized for each account — an old, no-longer-relevant key left in authorized_keys is a persistence risk if that key was ever compromised or belongs to someone no longer authorized.
Establishing an Offboarding Process
Rather than periodic cleanup alone, establish a clear process for removing access immediately when someone's authorization ends (employee departure, contractor engagement ending) — prevention is better than periodic detection.
Setting a Regular Audit Schedule
Perform this account audit on a regular cadence (quarterly, for example), not just once — account accumulation is an ongoing, gradual process that benefits from consistent periodic review.
Common Errors
Accidentally removing an account still needed by a running service — verify an account isn't a service account something depends on before deletion; check for any processes running as that user first.
Continue Reading
- How to Implement Role-Based Access Control for Compliance
- How to Implement the Principle of Least Privilege on a Linux VPS
- How to Monitor Auth Logs and Detect Intrusion Attempts on a Linux VPS
Browse more articles in Server Security & Hardening.
