> ## Documentation Index
> Fetch the complete documentation index at: https://vastai-80aa3a82-docs-host-security-hardening.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Accounts and Sudo

> Audit the accounts that can log in to a host machine, check who can become root, and remove accounts left from the machine's previous configuration.

Key-only SSH restricts how users authenticate. It does not limit which accounts
exist. A machine dedicated to hosting should have one account per
administrator and no others.

## Find every account that can log in

```bash theme={null}
awk -F: '$3>=1000 && $3<65534 {print $1, $3, $7}' /etc/passwd
```

```
youruser 1000 /bin/bash
ubuntu 1001 /bin/bash
oldadmin 1002 /bin/bash
```

`ubuntu` from a cloud image and `oldadmin` from the machine's previous
configuration are the accounts to look for.

## Check for accounts with no password set

```bash theme={null}
sudo awk -F: '$2 == "" {print $1 " HAS NO PASSWORD"}' /etc/shadow
```

```
(no output)
```

No output is the correct result.

## See who can become root

```bash theme={null}
getent group sudo
```

```
sudo:x:27:youruser
```

Then check for accounts that can `sudo` without a password prompt:

```bash theme={null}
sudo grep -rE 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ 2>/dev/null
```

```
(no output)
```

A `NOPASSWD` line is not necessarily wrong, because some monitoring agents
require one. Each line should be scoped to specific commands and should be one
you added deliberately.

## Remove accounts that are no longer needed

Lock an account before deleting it. Locking is reversible and confirms whether
anything on the machine depended on the account:

```bash theme={null}
sudo usermod -L -e 1 oldadmin
```

<Warning>
  Never run this against your own account. Your current session and `sudo` keep
  working, so the effect is not visible until your next login attempt.
</Warning>

Unlocking requires both flags. `usermod -U` unlocks the password but leaves the
expiry date, and the account still refuses logins with
`Your account has expired`:

```bash theme={null}
sudo usermod -U -e '' oldadmin
```

Before deleting an account, check what it owns and whether it is running
anything. `-xdev` keeps `find` on the root filesystem rather than descending
into container storage and network mounts, which on a host machine can take a
long time and compete with client I/O:

```bash theme={null}
sudo find / -xdev -user oldadmin 2>/dev/null | head
ps -u oldadmin
```

<Note>
  Container filesystems store raw numeric UIDs, so files created inside an
  instance can appear to belong to a host account with the same UID. Files under
  Docker's storage directory are not evidence that a host account is in use.

  Deleting an account frees its UID, and the next account created can inherit
  ownership of those files.
</Note>

Once nothing depends on the account, remove it with its home directory and
keys:

```bash theme={null}
sudo deluser --remove-home oldadmin
```