nologin tips — authorized non-login shell literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may set a nologin shell on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any write — never lock out production accounts without change control.
3. Record short factual notes; quote short Evidence (login, shell path used — never passwords).
4. Optional: interactive shell restore → chsh-tips / usermod-tips.
5. Optional: login-session literacy → login-tips.
6. Prefer the nologin path present on the authorized host (/usr/sbin/nologin vs /sbin/nologin) — quote which path you used.
7. Prefer disposable lab accounts for nologin drills.
8. Stop at literacy — no attack or unauthorized lockout cookbooks.

Allowed framing

• Classroom labs assigning /usr/sbin/nologin (or distro path) via chsh-tips / usermod-tips on authorized disposable accounts.
• Binding short factual notes as Evidence (shell path + observed login refusal — no secrets).
• Documenting service/system accounts that intentionally use nologin for authorized inventory notes.
• Comparing nologin ↔ chsh / usermod / login peer tip pages under one binder.
• Testing /etc/nologin message files when the syllabus authorizes that drill (distinct from shell path).

Scope we will not cover

• No crack/pirate/keygen via nologin.
• No intentional unauthorized lockouts against foreign hosts.
• No secret-theft or deceptive-banner cookbooks against hosts you do not own.
• No cookbooks that mass-assign nologin to shared/production users without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with a nologin binary installed.
2. Create a throwaway account via useradd-tips before any nologin drill.
3. With authorization, set the lab shell to nologin via chsh-tips or usermod-tips; quote login refusal as Evidence.
4. Optional: restore an interactive shell; pair session literacy with login-tips.
5. Stop at literacy — no attack or unauthorized lockout cookbooks.

Practical notes for authorized labs

• Distro paths differ (/usr/sbin/nologin vs /sbin/nologin) — quote the path that exists on the authorized host.
• Ensure the chosen path is listed in /etc/shells when the syllabus requires valid shells for chsh.
• /etc/nologin (file that blocks non-root logins) is a different surface — label it separately if the syllabus covers it.
• Service accounts often use nologin intentionally — inventory notes should distinguish lab drills from production posture.
• Never commit passwd dumps to git — even for labs.
• Pair with passwd-lock-tips when comparing lock vs non-login-shell levers (keep them distinct).

FAQ-aligned refusals (quick)

• Foreign-host lockouts → refuse.
• Unauthorized mass-nologin cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources