Disabling Dormant User Accounts

Requirements: CoreSSH Server

Accounts that are no longer used are easy to forget and hard to notice if they are later misused. CoreSSH Server can automatically disable user accounts that have not logged in successfully for a number of days. This guide covers enabling and disabling the account dormancy policy.

Enabling Account Dormancy

The account dormancy policy is configured in the Protection section of the Settings page.

Enter the number of days an account may go without a successful login in Disable Users Inactive For (Days), then click Save Settings. For example, a value of 90 disables any account that has not logged in for 90 days.

The server checks accounts about once an hour. When you first enable the policy, or lower the number of days, accounts whose last login is already older than the new value are disabled at the next check.

Disabling Account Dormancy

To turn the policy off, set Disable Users Inactive For (Days) to 0 and click Save Settings. This is the default, and inactive accounts are permitted to log in.

Logins are still recorded while the policy is off, so if you enable it later it works from each account's actual last login.

Which Accounts Are Affected

Only virtual users (accounts that CoreSSH Server authenticates itself) are affected. Windows user accounts, Windows groups, and macOS or Linux system accounts are never disabled by this policy; their lifecycle is managed by the operating system or Active Directory.

A newly created account, or any account with no recorded login, is given the full number of days from the first check. An account with a connection that is still open is treated as active.

Re-enabling an Account

An account disabled by the dormancy policy is disabled in the same way as an account disabled by an administrator. To restore access, open the Users page, select the account, and enable it. The account then has the full number of days before it can be disabled again.

When a disabled account attempts to log in, the server writes an informational log entry stating that the account is disabled either by an administrator or by the dormancy policy. Each account disabled by the policy is also logged with the number of days since its last login. For more detail in the log, see Enabling Verbose Logging for Troubleshooting.