Linux Account Lifecycle

What it means

Linux account lifecycle management governs creation, modification, suspension, deletion, home directories, shells, group membership, service identities, and residual access from onboarding through deprovisioning.

Why it matters

Deleting a username is not the same as removing access; keys, scheduled jobs, file ownership, tokens, and group-derived privileges can survive the account event.

Practical focus

• Define human, service, and application accounts on Linux systems and the identities, roles, and resources it covers
• Implement approved provisioning, unique identities, role-based groups, timely disablement, and artifact cleanup through least-privilege, reviewable policy
• Use account state, group changes, stale credentials, owned files, and login activity to confirm that effective access matches intended access
• Plan for an account being removed while keys, jobs, files, or delegated rights remain, including safe recovery and break-glass handling

Common mistakes

• Granting broad access because it is easier to administer
• Changing policy without testing the effective identity context
• Allowing exceptions to persist without an owner or expiration
• Treating an account being removed while keys, jobs, files, or delegated rights remain as a user problem instead of a control failure

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Authoritative sources

• NIST SP 800-53 Rev. 5 — Security and Privacy Controls
• NIST SP 800-123 — Guide to General Server Security