2

If creating a user with a shell of /sbin/nologin, is there any benefit / need to running passwd usernamegoeshere after creating the user and setting the password to something random or is that of no benefit?

I don't think this changes the answer, but this user might be used by cron for example as a way to run cron jobs with non-elevated privileges. It's not intended to be logged into by anyone via ssh, nor should they be permitted to do so.

  • I think password less ssh will still require the password be valid.😆 – Bratchley Aug 4 '16 at 4:55
  • @Bratchley I might not understand, but in this case nobody would be using SSH to log in as the user, so just need to ensure that by not running passwd it doesn't leave open the possibility that someone could authenticate as the user (such as by running su -s /bin/bash usernamegoeshere as a non-root user). I guess maybe another way to word my question is when a user is created, can anyone authenticate as them using a password if passwd hasn't been run (like does a default password get set that's not secure or something I'm not thinking of). Thanks – g491 Aug 4 '16 at 5:15
3

Typically for nologin shells you may want to also lock the account or set the password to be invalid. In /etc/shadow on Linux a locked account would have a password entry looking like !! and an invalid password would be *

eg on Debian Jessie:

/etc/passwd:backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
/etc/shadow:backup:*:16274:0:99999:7:::

On CentOS 7

/etc/passwd:sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
/etc/shadow:sshd:!!:16628::::::

Now it doesn't matter what is entered at the password prompt, it can not work.

  • Perfect - I confirmed it has the !! (CentOS 7) – g491 Aug 4 '16 at 17:28
0

Programs that rely on the password file for authentication typically fail when set to use the /sbin/nologin shell.

But that doesn't mean that it's not a good idea to set the password to something really strong, just in case some flawed program would ignore the shell specified.

Your approach seems like a fairly good idea although it may never be practically useful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.