On SLES 11 SP 2 I found out with webmin that lot of default users have the /bin/bash setting which in principle allows them to run in a SSH shell.

I consider it as a possible security risk.

My question:

Can I safely change for all the users in the below list the Shell setting to bin/false in order to disable any SSH connection?

enter image description here

  • I suppose that those users does not have a password set before. Because they mostly belong to a service for process ownership. The default behavior of SSH daemon is not to accept connections for blank passwords. That's why you do not need to change the default shells of those user. But still if you would like to change the shells, you can change them by modifying the /etc/passwd file. It would be better to set /sbin/nologin. May 21, 2017 at 13:23

2 Answers 2


Beware that setting a user's login shell to /bin/false (or /bin/true or /sbin/nologin which has the very minor benefit of displaying a custom message) breaks su to that user. Some system scripts may be using su.

Setting a user's shell to a program that does nothing is a security benefit, but only if the user would otherwise be able to log in due to a misconfiguration. A system user should have no way to authenticate, in which case the shell setting does not matter. So it's a good idea, but only if it doesn't break anything.

You can disable SSH access for some users in another way: by adding a DenyUsers directive in /etc/sshd_config. This will prevent those users from logging in over SSH, but won't prevent logging in through another service if that service is misconfigured.

Another way to block login to an account is through PAM. The advantage of this method is that you can have different settings for each service, e.g. allow su (which will only work for root if the account has no password) and disable anything else. You can use the pam_access module to deny certain users.


Rather than changing these account shells to /bin/false, I would recommend that you change them to /sbin/nologin or whatever path nologin is on SLES 11.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .