Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite
1

We have several user accounts that we create for automated tasks that require fine-grained permissions, such as file transfer across systems, monitoring, etc.

How do we lock down these user accounts so that these "users" have no shell and are not able to login? We want to prevent the possibility that someone can SSH in as one of these user accounts.

share|improve this question

3 Answers

up vote 6 down vote accepted

You can use the usermod command to change a user's login shell.

usermod -s /sbin/nologin myuser

If your OS does not provide /sbin/nologin, you can set the shell to a NOOP command such as /bin/false:

usermod -s /bin/false myuser
share|improve this answer
/bin/false seems more common than /bin/true. – jw013 Nov 7 '12 at 17:19
@jw013 I update my answer, but both should work fine. – jordanm Nov 7 '12 at 17:21
up vote 1 down vote

First, disable the password, using passwd -l username.

I also note in the man page for passwd for option -l:

   -l, --lock
       Lock the password of the named account. This option disables a password by changing it to a value which matches no
       possible encrypted value (it adds a ´!´ at the beginning of the password).

       Note that this does not disable the account. The user may still be able to login using another authentication token
       (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account's
       expire date to Jan 2, 1970).

       Users with a locked password are not allowed to change their password.
share|improve this answer
1  
This may not be desirable. They may need a password on their system account to access email for example. – jordanm Nov 7 '12 at 17:43
Some email systems allow use of their own password mechanisms. I use Dovecot and Exim with an email only password. This allows use of webmail on servers I would not use my system password. Virtual email domains require their own password as they aren't coupled to the servers password system. – BillThor Nov 8 '12 at 13:27
up vote 1 down vote

You edit the /etc/passwd file and change the users shell from /bin/bash, or /bin/sh to /sbin/nologin

share|improve this answer
3  
The answer is correct, but hand-editing /etc/passwd should never be recommended. – jordanm Nov 7 '12 at 17:06
Why? This is something we've been doing for as long as I've been a professional sys admin. (about 20 years now) In fact, not all linux/unix distros have tools for modifying /etc/passwd or /etc/group .. Unless you use something like Yast or Smit, which are tools that cache the settings and over-write them there is no harm in hand editing. – Mark Cohen Nov 7 '12 at 20:34
3  
It's much easier to make a "breaks everyone's login" mistake by hand-editing, rather than a single user. – jordanm Nov 7 '12 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.