A server administrator often has to work with user accounts — adding, deleting, and configuring access modes. Removing outdated user accounts is one security measure that can significantly reduce the number of vulnerabilities in the system.
The Linux utilities deluser
and userdel
are used for deletion. However, before proceeding directly to deleting a user, we must take certain steps.
In this article, we will explore how to delete a user in Ubuntu without compromising the system. At the same time, we will preserve the ability to access the user’s home directory files after deletion. In this article, we will work with the user hostman
, which was created beforehand.
This article will primarily focus on removing an Ubuntu user via the terminal, but we will also provide instructions for deleting a user account through the graphical interface.
Please note that you will need superuser privileges to work with user accounts.
The instructions will be suitable for any cloud server running Ubuntu OS.
First, you need to check whether the user is currently logged into the system. This will affect further steps: if the user is currently authorized on the server, you will need to terminate their connection and change the password.
Check the list of users authorized in the system using the who
utility or its alias w
:
who
If you see that the user hostman
is authorized, you need to check which processes are running under this user. This is a necessary step because if background operations are being performed, Ubuntu 22.04 will not allow us to delete the user. Check with the ps
utility:
sudo ps -u hostman
As a result, you might see a response like this:
PID TTY TIME CMD
1297129 pts/2 00:00:00 bash
1297443 pts/2 00:00:00 htop
For testing purposes, we launched the htop
utility under the hostman
account, which is running in the background.
Before stopping the user’s processes, you need to block their access to the system. You can do this by changing their password.
User passwords are stored in the system in encrypted form in the /etc/shadow
file. This file is readable only by the root
user, and in addition to password hashes, it contains their expiration information.
There is a special utility that allows you to remove a user’s password in Ubuntu — passwd
. To restrict access, we will use the passwd utility with the -l
(or --lock
) flag, which puts the utility into lock mode:
sudo passwd -l hostman
As a result, the utility will add an exclamation mark at the beginning of the encrypted password string. That is all that is needed to prevent the user from logging in again since the hashes will no longer match.
In Ubuntu, you cannot delete a user via the console if any processes are running under their name. To terminate a process, you can use one of the following commands:
kill
— deletes a process by its identifier. You can determine the IDs of the hostman
user processes with:
top -U hostman or ps -u hostman
pkill
— deletes a process by its name. For example, if the user hostman
has launched the top
process, you can terminate it with:
sudo pkill top
killall
— deletes all processes, including child processes. Often, a process will launch many so-called subprocesses; stopping them by name or identifier can be complex and time-consuming.
We will use the last command to reliably kill all user processes:
sudo killall -9 -u hostman
The -9
flag means the processes will receive a SIGKILL
signal. This means the process will be forcibly terminated, since this signal cannot be ignored or blocked. Essentially, it is equivalent to a “force quit” of a non-responding program in graphical operating systems.
After completing the user’s processes, they will no longer be authorized in the system. You can verify this using the who
command. Since we locked the login in the previous step, the hostman
user will not be able to log in again.
Quite often, when deleting a Linux user account, you may need to keep its home directory, which might contain important files required either by the user or by the organization you are serving as an administrator.
The built-in Ubuntu utilities allow you to remove a user while keeping their home directory. However, this is not recommended for two reasons:
Disk Space — the user’s home directory may contain a large amount of data. It is irrational and excessive to store data from all outdated accounts on the main work disk. Over time, you might run out of space for new users.
Data Relevance — it is good practice to keep the /home
directory containing only the directories corresponding to active user accounts. Keeping this list in order helps with administration.
We will use the tar
utility to archive the home directory of the hostman
user:
sudo tar -cvjf /mnt/nobackup/hostman.homedir.tar.gz /home/hostman
Let’s go over the arguments and flags:
-c
— creates the resulting .tar
archive file-v
— enables verbose mode, showing debugging information and listing archived files-z
— creates a compressed .gz
archive-f
— indicates that the first argument will be used as the archive nameThe first argument is the final location of the archive. In our example, we place the archive with the user’s home directory on the nobackup
disk, which, as the name implies, is not subject to backup.
The second argument is the path to the directory from which the archive is created.
Before deleting a user in Ubuntu, it is recommended to stop all cron scheduler tasks launched by that user. You can do this with the crontab
command. We will launch it under the hostman
user with the -u
flag and switch it to delete mode with the -r
flag:
sudo crontab -r -u hostman
Now you can be sure that after deleting the user account, no unknown scripts will be executed for which no one is responsible.
Once all the previous steps have been completed, it is time to proceed with the main task: deleting the Ubuntu user. There are two ways to do this: the deluser
and userdel
utilities.
To delete the user account, we will use the deluser
utility. Running it without parameters will delete the user account but leave their home directory and other user files intact. You can use the following flags:
--remove-home
— as the name suggests, deletes the user’s home directory
--remove-all-files
— deletes all system files belonging to the user, including the home directory
--backup
— creates an archive of the home directory and mail files and places it in the root directory. To specify a folder for saving the archive, use the --backup-to
flag.
As you can see from the parameter descriptions above, manually archiving the user’s home directory is not strictly necessary — deluser
can do everything for you. In addition, with deluser
you can remove a user from a group in Ubuntu or delete the group itself:
sudo deluser hostman administrators
The command above removes the user hostman
from the administrators
group.
Let’s proceed with the complete deletion of the user and the hostman
group without preserving the home directory:
sudo deluser --remove-home hostman
The entire article above is about how to delete a user in the Ubuntu terminal. But if you have a system with a graphical interface, you can delete a user in just a few simple steps.
Open the Users section in System Settings. To switch to superuser mode, click the Unlock button. After that, the Delete User button will become active. When you click it, a dialog box will appear, offering to delete the user’s files, specifically those in the home directory.
Deleting a user in Ubuntu is not difficult; you just need to use the deluser
utility with the required parameters. However, in this article, we described several steps that will help you safely delete a user account while preserving the system’s stability.