userdel tips — authorized account-delete literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run userdel on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any delete — never remove production accounts without change control.
3. Record short factual notes; quote short Evidence (login, UID, whether -r removed home — never passwords).
4. Optional: create path → useradd-tips.
5. Optional: modify path → usermod-tips.
6. Optional: group delete → groupdel-tips.
7. Prefer disposable lab accounts for delete drills; quote getent absence afterward as Evidence.
8. Stop at literacy — no attack or unauthorized account-wipe cookbooks.

Allowed framing

• Classroom labs reviewing userdel / userdel -r on authorized disposable accounts.
• Binding short factual notes as Evidence (login/UID/home-removal intent — no secrets).
• Documenting expected vs observed NSS absence for authorized inventory notes.
• Comparing userdel ↔ useradd / usermod / groupdel peer tip pages under one binder.
• Testing locked-login refusals when the syllabus authorizes that drill (account still logged in).

Scope we will not cover

• No crack/pirate/keygen via userdel.
• No intentional unauthorized account wipes against foreign hosts.
• No secret-theft or home-directory exfiltration against hosts you do not own.
• No cookbooks that mass-delete production or shared UIDs without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with shadow-utils installed.
2. Create a throwaway account via useradd-tips before any userdel drill.
3. With authorization, delete the lab account (userdel or userdel -r); quote getent passwd absence as Evidence.
4. Optional: group cleanup with groupdel-tips when the syllabus covers orphan groups.
5. Stop at literacy — no attack or unauthorized account-delete cookbooks.

Practical notes for authorized labs

• -r removes the home directory and mail spool when present — quote whether the syllabus asked for it.
• Prefer deleting disposable lab accounts; never experiment on shared production UIDs.
• Pair with getent-tips for before/after NSS Evidence.
• Processes still owned by the deleted UID may linger — inventory notes should mention follow-up when the syllabus covers it.
• Never commit before/after passwd dumps to git — even for labs.
• Label lab-only deletes clearly so they are not mistaken for production posture.

FAQ-aligned refusals (quick)

• Foreign-host account deletes → refuse.
• Unauthorized mass-wipe cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources