Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Let's say I create a user named "bogus" using the adduser command. How can I make sure this user will NOT be a viable login option, without disabling the account. In short, I want the account to be accessible via su - bogus, but I do not want it to be accessible via a regular login prompt.

Searching around, it seems I need to disable that user's password, but doing passwd -d bogus didn't help. In fact, it made things worse, because I could now login to bogus without even typing a password.

Is there a way to disable regular logins for a given a account?

Note: Just to be clear, I know how to remove a user from the menu options of graphical login screens such as gdm, but these methods simply hide the account without actually disabling login. I'm looking for a way to disable regular login completely, text-mode included.

share|improve this question
1  
Your -d is the flag to delete the password. That is different from disabling it (refereed to as locking, see Chad's answer). –  Caleb Aug 24 '11 at 20:59

4 Answers 4

up vote 37 down vote accepted

passwd -l

is what you want.

That will lock the user account. But you'll still be able to

su - user

but you'll have to su - user as root.

Alternatively, you can accomplish the same thing by prepending a ! to the user's password in /etc/shadow (this is all passwd -l does behind the scenes). passwd -u will undo it.

share|improve this answer
4  
By using the passwd -l option you should be aware that the user could login using another authentication token (e.g. an SSH key). –  pl1nk Feb 20 '13 at 16:42
    
Please see my answer below on a recommended solution on how to avoid this. –  george g Oct 29 at 15:58

There are two methods to prevent a user from being able to login:

  1. you can lock the user by editing /etc/passwd
  2. by directly issuing the passwd command with the -l switch

Method #1

  1. open a terminal and login as root
  2. type vi /etc/passwd

Now you are in passwd file press Ins to edit the file.

Change the below line with the nologin option (/bin/bash means the user is able to login).

root:x:0:0:root:/root:/bin/bash

to this. nologin means the user is unable to login.

root:x:0:0:root:/root:/bin/nologin

Method #2

To lock user: passwd -l username

To unlock user: passwd -u username

share|improve this answer
    
On an Ubuntu 14.04 system, I found /usr/sbin/nologin instead of /bin/nologin. –  Dennis Williamson Oct 10 at 23:25

The man page of passwd(1) says about passwd -l:

Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account's expire date to Jan 2, 1970).

So

usermod --expiredate 1 [LOGIN]

seems to me like the right way to disable an account a user should not be able to use anymore (e.g. because he left the company).

share|improve this answer

Set /bin/false as a shell in /etc/passwd

share|improve this answer
11  
When one sets the shell to /bin/false, one prevents using su to act as that user. Additionally, using /bin/false produces no error nor other hint of what just went wrong -- in cases where one does want to prevent even su from being used to get a shell as that user, the shell should be changed to /sbin/nologin which does produce an error. –  HedgeMage Aug 24 '11 at 16:22
2  
No, the su is still possible for users with /bin/false shells in passwd - just use the option --shell: su - --shell /bin/sh bogus. –  Matej Kovac Feb 27 at 9:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.