Linux · users & permissions

userdel

remove a user

userdel removes an account from the system. Without -r the home directory is left behind, owned by a number that no longer has a name — and that a future account may be given.

Decide what happens to the files first: archive them, then userdel -r.

Removes

The account

from passwd, shadow and group

Home too

-r

otherwise it stays

Refuses if

The user is logged in

or has processes running

Elsewhere

Files remain

find them by user id

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

root@netflow — bashpasswd

# userdel olduser

1userdel: user olduser is currently used by process 4127

2# pkill -u olduser

3# userdel -r olduser

4# find / -xdev -nouser 2>/dev/null

/srv/shared/report-old.xlsx

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Still in use

The account has a process running, so userdel refuses rather than leave it orphaned.

Stop their processes

pkill -u ends everything the user is running.

Account and home removed

-r deletes /home/olduser and the mail spool along with the account. Nothing is printed on success.

Files left elsewhere

-nouser finds files whose owner id no longer matches any account. This one, outside the home directory, was missed by -r.

Switches

A switch changes how the command behaves. These are the ones used day to day; man userdel lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-r: Remove the home directory and mail spool too.
-f: Force removal even if the user is logged in. Dangerous.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo tar -czf olduser-home.tar.gz /home/olduser

Archives the home directory before deleting the account.

sudo userdel -r olduser

Deletes the account with its home directory.

sudo find / -xdev -uid 1003

Finds every file owned by a given user id.

sudo deluser --remove-home olduser

The Debian and Ubuntu wrapper for the same job.

In cybersecurity

Removing an account is part of the job when someone leaves — and easy to do halfway.

User ids get reused

Files left behind are owned by a bare number. The next account created may be given that number and inherit them all.

Check for what else they left

Cron jobs, SSH keys in other accounts’ authorized_keys, and running processes outlive the account unless they are removed too.

Disable first, delete later

Locking an account at once and deleting it after a retention period keeps the evidence and the files while removing the access.

Filed under

Users & permissions

Read alongside

useraddCreates a new user account: an entry in /etc/passwd, a group, and optionally a home directory.usermodChanges an existing account: its groups, shell, home directory, name, or whether it is locked.