You must lock the password of the account bob so that he cannot authenticate with it, while leaving the account and its files in place. Select the TWO commands that achieve exactly that.
LPIC-1 Exam 102-500, objective 107. Administrative tasks medium
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Choose 2.
Not correct passwd -d bob
Wrong, and the opposite of safe. -d deletes the password, leaving the field empty. Depending on PAM configuration that can permit login with no password at all.
Correct usermod -L bob
Correct. -L locks the password by prefixing the stored hash in /etc/shadow with an exclamation mark, so no supplied password can ever hash to a match. usermod -U reverses it.
Not correct userdel bob
Wrong. This removes the account entirely from /etc/passwd, /etc/shadow and the group files. Nothing is left to unlock later.
Correct passwd -l bob
Correct. -l locks the account's password in the same way, by prefixing the hash so it cannot match. passwd -u unlocks it, and passwd -S reports the current state.
Not correct usermod -s /sbin/nologin bob
Wrong for this requirement. Changing the shell blocks interactive login sessions, but it does not lock the password, so services that authenticate against it without spawning a shell can still accept it.
Why
Locking works by making the stored hash unmatchable: the ! prefix means no input can ever hash to that string, while the original hash is preserved so unlocking restores the old password. Locking the password does not stop SSH public-key logins, which is why hardening an account often means locking the password AND setting a nologin shell.
Where this comes from
- Cited
- LPI exam objective 107.1
- What it says
- Lock and unlock user accounts and change passwords.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 107 and space the ones you get wrong.