Fedora Inactive/Disabled Accounts

In a recent #fedora-admin IRC conversation, it was asked if Fedora Infrastructure ever makes accounts inactive. We have done this a couple of times in the past,  usually after a security breach where password hashes may have been seen. While happily we have not had a security event happen in a while.. we did have a large amount of spam accounts created which have taken up a bunch of names that people may want to use (if you have wanted vipin1 -> vipin357, nagar1 -> nagar240, or many others, you are currently out of luck). We also have many users who created accounts, and either never logged into FAS again or haven't for over a year or more.

Now for some projects you would regularly set these accounts to inactive or clear them out for reuse. Free software projects usually do not have the luxury for doing this for several reasons:

1. The Norwegian Blue Parrot Problem.
   In this case, we find that many users have not been deceased, but like a true Norwegian Blue have been pining for the fnords. This means that even a year after you have set accounts to inactive there is a large amount of "why is my account locked?" emails and general grumpiness of people finding that someone had locked their account without their permission. [It also leads into the argument sketch and other too much silliness.]
2. This account was used for something in the past and we need to keep track of things for licensing reasons. While someone might want the account thegreatandmightyoz and that account is no longer active.. if that account put in patches or other items into Fedora.. those inclusions may be tracked via the userid in one of the many Fedora sub-systems. [Yes they should be tracked by the UID or some other non-changing ID, but that is 10 years too late for some inclusions.] Because of this if someone else gets the 'thegreatandmightyoz' they could they could get additional responsibilities (what do you mean I need to fix this bug? I am just a circus man from Kansas not a real wizard!)

For the second problem, we are looking at making changes in the new FAS system so that we can give users an 'EPOCH' where 0:thegreatandmightyoz is different from 1:thegreatandmightyoz in various systems trying to figure out what is linked to whom. For the first problem, we will work out a system of saying that a user who has not logged in for N days (where N is greater than say 270 days ) will be set for inactive. We would then advertise quite a bit before doing it and then get ready for a long list of arguments and complaints :).