How do you lock and unlock a user account?

Question

Accepted Answer

usermod -L (or passwd -l) locks the PASSWORD by prepending a ! to the hash, and -U/-u reverses it — but note a locked password does NOT block SSH key login, so true lockout often also needs -e 1 (expire) and a nologin shell.
The subtlety worth internalizing: "locking a password" only disables password authentication. An attacker (or admin) with an authorized SSH key can still log in. To fully shut an account you combine methods — expire the account (usermod -e 1 / chage -E 0) and set the shell to /sbin/nologin. Check state with passwd -S user (shows LK for locked). For permanent removal, userdel -r.
Method 1: Lock password (usermod -L)
sudo usermod -L username    # Lock (prepends ! to password)
sudo usermod -U username    # Unlock

User can't login with password
SSH key login still works!

Method 2: Disable shell
sudo usermod -s /sbin/nologin username
sudo usermod -s /bin/false username

User can't get interactive shell
Still allows some services (mail, FTP)

Method 3: Expire account
sudo usermod -e 1 username           # Expire immediately
sudo usermod -e "" username          # Remove expiration
sudo chage -E 0 username             # Expire immediately

Method 4: Lock in shadow file
sudo passwd -l username    # Lock
sudo passwd -u username    # Unlock

Check if locked:
sudo passwd -S username
# username LK 2024-01-15 ... (LK = locked)

Complete lockout:
sudo usermod -L -e 1 -s /sbin/nologin username

Tip: For temporary lockout, use usermod -L. For permanent removal, use userdel.