What's the difference between locking and expiring a user account? usermod -e 1 *username* will have the effect of **_expiring_** a user account but usermod - L *username* will lock the said account. Are there any specific differences between the two? In my opinion, either one of them should achieve the goal of locking out a user from authenticating their account. Why would we need an expiration mechanism when one could lock/or delete the account in question?

The expiration mechanism is needed to expire the account in the future. Say like a service account that can be used for a week or so.

The locking mechanism works only for local password login, not with other login mechanisms like PAM or ssh key.

`man usermod` explicitly says if you want to disable an account, you also have to expire it, not just lock it. Therefore, `usermod -e 1 username` is the correct way to lock an account.