Removing a User Account

Removing a User Account
	Chapter 12. Administering User Accounts

Before removing an account, it is best to make a backup copy of the user's home volume on a permanent storage medium such as tape. If you need to remove several accounts, it is probably more efficient to use the uss delete command instead; see Deleting Individual Accounts with the uss delete Command.

To remove a user account

Authenticate as an AFS identity with all of the following privileges. In the conventional configuration, the admin user account has them, or you possibly have a personal administrative account. (To increase cell security, it is best to create special privileged accounts for use only while performing administrative procedures; for further discussion, see An Overview of Administrative Privilege.) If necessary, issue the klog command to authenticate.
```
   % klog admin_user
   Password: <admin_password>
```
The following list specifies the necessary privileges and indicates how to check that you have them.
- Membership in the system:administrators group. If necessary, issue the pts membership command, which is fully described in To display the members of the system:administrators group.
```
   % pts membership system:administrators
```
- Inclusion in the /usr/afs/etc/UserList file. If necessary, issue the bos listusers command, which is fully described in To display the users in the UserList file.
```
   % bos listusers <machine name>
```
- The ADMIN flag on the Authentication Database entry. However, the Authentication Server performs its own authentication, so the following instructions direct you to specify an administrative identity on the kas command line itself.
- The d (delete) permission on the ACL of the directory where you are removing the user volume's mount point. If necessary, issue the fs listacl command, which is fully described in Displaying ACLs.
```
   % fs listacl [<dir/file path>]
```
  Members of the system:administrators group always implicitly have the a (administer) and by default also the l (lookup) permission on every ACL and can use the fs setacl command to grant other rights as necessary.
(Optional) If it is possible you need to restore the user's account someday, note the username and AFS UID, possibly in a file designated for that purpose. You can later restore the account with its original AFS UID.
(Optional) Copy the contents of the user's volume to tape. You can use the vos dump command as described in Dumping and Restoring Volumes or the AFS Backup System as described in Backing Up Data.
(Optional) If you intend to remove groups that the user owns from the Protection Database after removing the user's entry, issue the pts listowned command to display them. For complete instructions, see Displaying Information from the Protection Database.
```
   % pts listowned <user or group name or id>
```
(Optional) Issue the pts delete command to remove the groups the user owns. However, if it is likely that other users have placed the groups on the ACLs of directories they own, it is best not to remove them.
```
   % pts delete <user or group name or id>+
```
where
del
Is the shortest acceptable abbreviation for delete.
user or group name or id
Specifies the name or AFS UID of each group displayed in the output from Step 4.
Issue the kas delete command to remove the user's Authentication Database entry.
The Authentication Server performs its own authentication rather than accepting your existing AFS token. By default, it authenticates your local (UNIX) identity, which possibly does not correspond to an AFS-privileged administrator. Include the -admin argument to name an identity that has the ADMIN flag on its Authentication Database entry. To verify that an entry has the flag, issue the kas examine command as described in To check if the ADMIN flag is set.
```
   % kas delete <name of user>  \
                -admin  <admin principal to use for authentication>  
   Administrator's (admin_user) password: <admin_password>
```
where
d
Is the shortest acceptable abbreviation for delete.
name of user
Names the Authentication Database entry to delete.
-admin
Names an administrative account that has the ADMIN flag on its Authentication Database entry, such as admin. The password prompt echoes it as admin_user. Enter the appropriate password as admin_password.
Issue the vos listvldb command to display the site of the user's home volume in preparation for removing it. By convention, user volumes are named user.username.
```
   % vos listvldb <volume name or ID>
```
where
listvl
Is the shortest acceptable abbreviation of listvldb.
volume name or ID
Specifies the volume's name or volume ID number.
Issue the vos remove command to remove the user's volume. It automatically removes the backup version of the volume, if it exists. It is not conventional to replicate user volumes, so the command usually also completely removes the volume's entry from the Volume Location Database (VLDB). If there are ReadOnly replicas of the volume, you must repeat the vos remove command to remove each one individually.
```
   % vos remove <machine name> <partition name> <volume name or ID>
```
where
remo
Is the shortest acceptable abbreviation of remove.
machine name
Names the file server machine that houses the volume, as specified in the output from Step 7.
partition name
Names the partition that houses the volume, as specified in the output from Step 7.
volume name or ID
Specifies the volume's name or ID number.
Issue the fs rmmount command to remove the volume's mount point.
If you mounted the user's backup volume as a subdirectory of the home directory, then this command is sufficient to unmount the backup version as well. If you mounted the backup version at an unrelated location in the filespace, repeat the fs rmmount command for it.
```
   % fs rmmount <directory>
```
where
rmm
Is the shortest acceptable abbreviation of rmmount.
directory
Names the mount point for the volume's previous name (the former home directory). Partial pathnames are interpreted relative to the current working directory.
Specify the read/write path to the mount point, to avoid the failure that results when you attempt to delete a mount point from a read-only volume. By convention, you indicate the read/write path by placing a period before the cell name at the pathname's second level (for example, /afs/.example.com). For further discussion of the concept of read/write and read-only paths through the filespace, see Mounting Volumes.
Issue the pts delete command to remove the user's Protection Database entry. A complete description of this command appears in Step 5.
```
   % pts delete <user or group name or id>
```
If the deleted user home directory resided in a replicated volume, use the vos release command to release the volume, as described in To replicate a read/write volume (create a read-only volume).
```
   % vos release <volume name or ID>
```
Note
This step can be necessary even if the home directory's parent directory is not itself a mount point for a replicated volume (and is easier to overlook in that case). For example, the Example Corporation template puts the mount points for user volumes in the /afs/example.com/usr directory. Because that is a regular directory rather than a mount point, it resides in the root.cell volume mounted at the /afs/example.com directory. That volume is replicated, so after changing it by deleting a mount point the administrator must issue the vos release command.


Changing Usernames		Chapter 13. Administering the Protection Database

Removing a User Account

To remove a user account

Note