Removing shell access from Samba domain user accounts

Question

I have a Samba domain server that houses network shares for AD users. All of the users are created on this server as regular linux users and, as such, are given shell access. I have to remove shell access for the vast majority of these users and I'm thinking of changing the default shell in /etc/passwd from /bin/bash to either /sbin/nologin or /bin/false but will this affect their ability to get to their shares on the server?

Answer 1

No, giving users a shell like /sbin/nologin or /bin/false won't prevent them from access their samba shares. In fact, it's a pretty common/normal way of doing what you want.

Note, however, that if complex group memberships are important, you're probably better off not having local users or groups for most if not all samba users, but to rely on AD instead - AD supports nested group membership (i.e. a group can be a member of another group). Unix groups don't and can't do that.

(I know this because I once had to write a perl script to extract user and group names for a particular faculty from an AD server and generate local accounts & groups for them...because the Uni I was working for didn't want to install AD's unix extension on their central IT-managed AD server)