Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I suspect they actually do something. So what's the difference? why do they both exist? Why would I use one over the other?

-rwxr-xr-x 1 root root  21K Feb  4 17:01 /bin/false
-rwxr-xr-x 1 root root 4.7K Mar  2 14:59 /sbin/nologin
share|improve this question
add comment

7 Answers

up vote 23 down vote accepted

When /sbin/nologin is set as the shell, if user with that shell logs in, they'll get a polite message saying 'This account is currently not available.'. This message can be changed with the file /etc/nologin.txt.

/bin/false is just a binary that immediately exits, returning false, when its called, so when someone who has false as shell logs in, they're immediately logged out when false exits. Setting the shell to /bin/true has the same affect of not allowing someone to log in but false is probably used as a convention over true since its much better at conveying the concept that person doesn't have a shell.

Looking at nologin's man page, it says it was created in 4.4 BSD (early 1990s) so it came long after false was created. The use of false as a shell is probably just a convention carried over from the early days of UNIX.

nologin is the more user friendly option, with a customizable message given to the user trying to login, so you would theoretically want to use that but both nologin and false will have the same end result of someone not having a shell and not being able to ssh in.

share|improve this answer
add comment

Some FTP servers will allow you FTP access only if you have a valid shell. /sbin/nologin is regarded as a valid shell, whereas /bin/false is not.

(I think "valid" means its exit status is 0, but /etc/shells may also come into it, it probably depends on the system, the FTP software, and your configuration.)

share|improve this answer
1  
yeah, that's probably part of the ftp program using pam, and pam using pam_shells which as you said, checks /etc/shells. Just a guess... I could be wrong. –  xenoterracide Apr 7 '11 at 21:43
add comment

/bin/false is a system command that is used anytime you need to pass a command to a program that should do nothing more than exit with an error. It's the companion to /bin/true. Both of these are very old and standard POSIX utilities and neither produce any output by definition. true is sometimes used for a shell script that should loop indefinitely, like:

while true; do
    ...
    # Waste time
    if [ $wasted_time -gt 100000 ]; then
        exit 0
    fi
    ...
done

/usr/sbin/nologin is specifically designed to replace a shell and produces output complaining you can't log-in. Before it existed, it was common to use /bin/false for dummy users, but could be confusing since the user doesn't know why they're kicked off.

share|improve this answer
2  
worth noting that /bin/true and /bin/false are not always what you will get in a shell script. In zsh true and false are built-ins, where bash uses the /bin/* versions –  xenoterracide Apr 8 '11 at 13:04
add comment

On my machine, nologin displays always the same message, in English, ignoring arguments. /bin/false responds to --version and --help in the language indicated by $LC_CTYPE. Other than these cosmetic differences, they have the same effect.

Usability-wise, nologin is better if it's used on the account of a real person who speaks English. Security-wise, there is no difference.

share|improve this answer
4  
seems like perhaps false is more for system accounts that have no real user, and nologin is for disabled accounts. –  xenoterracide Apr 7 '11 at 20:26
add comment

/bin/false only job is to exit with a non-zero exit code.

Try it at the command line:

$:> /bin/false
$:> echo $?
1
$:>

Some institutions use /bin/false in the shell field of the password file. If user tries to login, the shell is /bin/false, so they are exited right away

I hope this helps.

share|improve this answer
add comment

On linux, /sbin/nologin comes from the util-linux project, while /bin/false is part of GNU Coreutils. They serve different roles, and nologin has the option of printing a message for people who have it as their shell who are logging in. The linux commands come from BSD, where they seem to have a long history of being different. The FreeBSD false simply returns 1, while the nologin checks to make sure it's running on a TTY and sends a message to syslog during login attempts. The linux versions are a bit more complicated (false doing all sorts of fun stuff with internationalization for the output of --help, I assume) but essentially perform the same way.

share|improve this answer
add comment

They could be the same program, but they have different meanings. The program name tells it all.

  • /bin/false is intended to return a false value. It is run as progmam.
  • /bin/nologin is indented to indicate that no login is permitted for an account. (It is used a login shell.)
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.