Accounts and Sudo

Audit the accounts that can log in to a host machine, check who can become root, and remove accounts left from the machine’s previous configuration.

Key-only SSH restricts how users authenticate. It does not limit which accounts exist. A machine dedicated to hosting should have one account per administrator and no others.

Find every account that can log in

awk -F: '$3>=1000 && $3<65534 {print $1, $3, $7}' /etc/passwd

youruser 1000 /bin/bash
ubuntu 1001 /bin/bash
oldadmin 1002 /bin/bash

ubuntu from a cloud image and oldadmin from the machine’s previous configuration are the accounts to look for.

Check for accounts with no password set

sudo awk -F: '$2 == "" {print $1 " HAS NO PASSWORD"}' /etc/shadow

(no output)

No output is the correct result.

See who can become root

getent group sudo

sudo:x:27:youruser

Then check for accounts that can sudo without a password prompt:

sudo grep -rE 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ 2>/dev/null

(no output)

A NOPASSWD line is not necessarily wrong, because some monitoring agents require one. Each line should be scoped to specific commands and should be one you added deliberately.

Remove accounts that are no longer needed

Lock an account before deleting it. Locking is reversible and confirms whether anything on the machine depended on the account:

sudo usermod -L -e 1 oldadmin

Never run this against your own account. Your current session and sudo keep working, so the effect is not visible until your next login attempt.

Unlocking requires both flags. usermod -U unlocks the password but leaves the expiry date, and the account still refuses logins with Your account has expired:

sudo usermod -U -e '' oldadmin

Before deleting an account, check what it owns and whether it is running anything. -xdev keeps find on the root filesystem rather than descending into container storage and network mounts, which on a host machine can take a long time and compete with client I/O:

sudo find / -xdev -user oldadmin 2>/dev/null | head
ps -u oldadmin

Container filesystems store raw numeric UIDs, so files created inside an instance can appear to belong to a host account with the same UID. Files under Docker’s storage directory are not evidence that a host account is in use.

Deleting an account frees its UID, and the next account created can inherit ownership of those files.

Once nothing depends on the account, remove it with its home directory and keys:

sudo deluser --remove-home oldadmin