<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>The reasons that have already been stated are all good, and I'll add to it with something that comes from my own experience. </div><div><br></div><div>As a web hosting company, we see alot of legacy installs with software running as a particular user, and it's dependant on their UID, crontab and such, and the other users have their own UID's instead of jiggering with the passwd file to give them the same UID. In cases like that, we can't really remove the user without breaking stuff. So in those cases, we add some stuff before the password in the shadow file and make damned sure that the users authorized_keys file has been blanked. That way none of the users data is lost and we can still su to the account if needed if needed for anything. </div><div><br></div><div>What's really annoying is when the user has access to the phpmyadmin install and the company uses the same username and password for their apps that they use to administer the databases. </div><br><div><div>On Aug 7, 2008, at 12:32 PM, Jeff Lightner wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div> <div> <!-- Converted from text/rtf format --><p dir="LTR"><span lang="en-us"></span><span lang="en-us"><font size="2" face="Arial">At a former job the policy was to disable rather than remove user accounts.</font></span><span lang="en-us"></span><span lang="en-us"></span></p><div><span lang="en-us"></span><span lang="en-us"></span><br class="webkit-block-placeholder"></div><p dir="LTR"><span lang="en-us"><font size="2" face="Arial">However, on checking for</font></span><span lang="en-us"></span><span lang="en-us"> <font size="2" face="Arial">“</font></span><span lang="en-us"></span><span lang="en-us"><font size="2" face="Arial">best practices</font></span><span lang="en-us"></span><span lang="en-us"><font size="2" face="Arial">”</font></span><span lang="en-us"></span><span lang="en-us"><font size="2" face="Arial"> I don</font></span><span lang="en-us"></span><span lang="en-us"><font size="2" face="Arial">’</font></span><span lang="en-us"></span><span lang="en-us"><font size="2" face="Arial">t find any indication why this should be and find several references to removing them completely.</font></span></p><p dir="LTR"><span lang="en-us"><font size="2" face="Arial">Does anyone know of a best practice that</font></span><span lang="en-us"></span><span lang="en-us"> <font size="2" face="Arial">explains</font></span><span lang="en-us"></span><span lang="en-us"><font size="2" face="Arial"> why</font></span><span lang="en-us"></span><span lang="en-us"><font size="2" face="Arial"> disabling</font></span><span lang="en-us"></span><span lang="en-us"> <font size="2" face="Arial">would be preferable to</font></span><span lang="en-us"></span><span lang="en-us"> <font size="2" face="Arial">removing?</font></span><span lang="en-us"></span><span lang="en-us"></span></p> </div> <div style="FONT-SIZE: 9pt; FONT-FAMILY: Courier New"> <font face="Arial" size="2">----------------------------------<br>CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.<br>----------------------------------<br></font> </div></div> _______________________________________________<br>Ale mailing list<br><a href="mailto:Ale@ale.org">Ale@ale.org</a><br>http://mail.ale.org/mailman/listinfo/ale<br></blockquote></div><br></body></html>