Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I suspect they actually do something. So what's the difference? why do they both exist? Why would I use one over the other?

-rwxr-xr-x 1 root root  21K Feb  4 17:01 /bin/false
-rwxr-xr-x 1 root root 4.7K Mar  2 14:59 /sbin/nologin

8 Answers 8


When /sbin/nologin is set as the shell, if user with that shell logs in, they'll get a polite message saying 'This account is currently not available.' This message can be changed with the file /etc/nologin.txt.

/bin/false is just a binary that immediately exits, returning false, when it's called, so when someone who has false as shell logs in, they're immediately logged out when false exits. Setting the shell to /bin/true has the same effect of not allowing someone to log in but false is probably used as a convention over true since it's much better at conveying the concept that person doesn't have a shell.

Looking at nologin's man page, it says it was created in 4.4 BSD (early 1990s) so it came long after false was created. The use of false as a shell is probably just a convention carried over from the early days of UNIX.

nologin is the more user-friendly option, with a customizable message given to the user trying to log in, so you would theoretically want to use that; but both nologin and false will have the same end result of someone not having a shell and not being able to ssh in.

  • 22
    /usr/sbin/nologin for Debian based distributions.
    – Diemo
    Dec 31, 2017 at 5:51
  • 5
    At least BSD implementation also logs the login attempts to syslog as seen in opensource.apple.com/source/system_cmds/system_cmds-735/… , whereas /bin/false wouldn't log anything Sep 10, 2018 at 23:44
  • THIS - Is an amazing answer, with great history presented here. Well done Mark! May 3, 2020 at 0:09
  • 1
    The /etc/nologin.txt custom message feature is not available in Ubuntu.
    – Paul
    Jun 3, 2020 at 12:52

Some FTP servers will allow you FTP access only if you have a valid shell. /sbin/nologin is regarded as a valid shell, whereas /bin/false is not.

(I think "valid" means its exit status is 0, but /etc/shells may also come into it, it probably depends on the system, the FTP software, and your configuration.)

  • 1
    yeah, that's probably part of the ftp program using pam, and pam using pam_shells which as you said, checks /etc/shells. Just a guess... I could be wrong. Apr 7, 2011 at 21:43
  • 7
    I just checked both Ubuntu 8.04 and 14.04. The nologin command exits with status 1 similar to false, and none of true, false, or nologin are included in /etc/shells. If they were, a user could use chsh to select such a shell and lock himself out of his account.
    – penguin359
    Jul 21, 2015 at 20:30

/bin/false is a system command that is used anytime you need to pass a command to a program that should do nothing more than exit with an error. It's the companion to /bin/true. Both of these are very old and standard POSIX utilities and neither produce any output by definition. true is sometimes used for a shell script that should loop indefinitely, like:

while true; do
    # Waste time
    if [ $wasted_time -gt 100000 ]; then
        exit 0

/usr/sbin/nologin is specifically designed to replace a shell and produces output complaining you can't log-in. Before it existed, it was common to use /bin/false for dummy users, but could be confusing since the user doesn't know why they're kicked off.

  • 4
    worth noting that /bin/true and /bin/false are not always what you will get in a shell script. In zsh true and false are built-ins, where bash uses the /bin/* versions Apr 8, 2011 at 13:04

On my machine, nologin displays always the same message, in English, ignoring arguments. /bin/false responds to --version and --help in the language indicated by $LC_CTYPE. Other than these cosmetic differences, they have the same effect.

Usability-wise, nologin is better if it's used on the account of a real person who speaks English. Security-wise, there is no difference.

  • 4
    seems like perhaps false is more for system accounts that have no real user, and nologin is for disabled accounts. Apr 7, 2011 at 20:26
  • 1
    What is your OS? Centos nologin version takes no arguments, but can read message from /etc/nologin.txt . Oct 20, 2017 at 7:04

On linux, /sbin/nologin comes from the util-linux project, while /bin/false is part of GNU Coreutils. They serve different roles, and nologin has the option of printing a message for people who have it as their shell who are logging in. The linux commands come from BSD, where they seem to have a long history of being different. The FreeBSD false simply returns 1, while the nologin checks to make sure it's running on a TTY and sends a message to syslog during login attempts. The linux versions are a bit more complicated (false doing all sorts of fun stuff with internationalization for the output of --help, I assume) but essentially perform the same way.


/bin/false only job is to exit with a non-zero exit code.

Try it at the command line:

$:> /bin/false
$:> echo $?

Some institutions use /bin/false in the shell field of the password file. If user tries to login, the shell is /bin/false, so they are exited right away


They could be the same program, but they have different meanings. The program name tells it all.

  • /bin/false is intended to return a false value. It is run as program.
  • /bin/nologin is intended to indicate to the user that no login is permitted for an account. (It is used a login shell.)

Both does more or less the same job but /bin/false is useful for non-privileged users . On the other hand, /sbin/nologin is for privileged users.

  • 5
    Oh, how did you come to that conclusion?
    – fpmurphy
    Dec 27, 2015 at 0:11
  • 1
    Probably he has looked into /etc/passwd. I just had a look into /etc/passwd of a freshly installed Debian stretch. On this box, nearly all system accounts (user ids < 1000) have /usr/sbin/nologin as shell, with a few exceptions. Please note that I do not agree with @pythondetective's answer. I am just speculating what might have lead him to this conclusion. My comment is a little bit late, though.
    – Binarus
    Dec 10, 2018 at 17:29
  • no! default login shell is not the same as privileges. Apr 15, 2019 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.