Offboard a departing employee properly

applied · 40 min · Objective 2.2

Before you start — what this lab needs

A disposable virtual machine with sshd running, or a container with sshd installed. You will lock, expire and delete accounts, so it must be a machine you can destroy:

podman run -d --name lab-offboard --rm rockylinux:9 sleep infinity
podman exec -it lab-offboard bash
dnf install -y openssh-server && ssh-keygen -A

Task

Remove an employee's access completely, in a way that survives the gap the usual approach leaves. Locking the password is what most people do; you will demonstrate that it is insufficient, then do the job properly, and produce evidence that the access is gone.

Steps

Create the departing user with a password and a home directory, add them to wheel, and place an SSH public key in their authorized_keys.
Record their access: id, passwd -S, and the presence of the key.
Do the usual thing -- passwd -l -- and show that the password hash is now prefixed with ! while authorized_keys is untouched. State plainly what an attacker holding the private key can still do.
Close the gap. Expire the account with chage -E, set the shell to /sbin/nologin, and remove or rename the authorised key file.
Find every file on the system they own, before deleting anything: find / -xdev -uid $(id -u departing) 2>/dev/null.
Decide, and record the reason, whether to expire or delete. For a departure, expiring preserves file ownership and audit trails while stopping access.
If deleting, use userdel -r and explain what happens to the files found in step 5 that live outside the home directory.

Verify

chage -l departing | grep -i 'account expires'      # a date in the past
getent passwd departing | cut -d: -f7               # nologin
sudo test -s /home/departing/.ssh/authorized_keys && echo "KEY STILL PRESENT" || echo "no key"
sudo passwd -S departing | awk '{print $2}'         # L
find / -xdev -uid "$(id -u departing 2>/dev/null || echo 99999)" 2>/dev/null | head

All four of the first checks must agree that access is closed. The point of the lab is that after step 3 only the last of them did, and the account was still reachable by anyone holding the key.

Notes

The reason expiry beats locking is that it is checked by the account stage of PAM, which every authentication method passes through -- password, key, or anything else. Locking only alters the stored hash, which key authentication never consults.