4 ms·
I don't remember the flag, but this could be my answer: Most linux distributions, come with /bin/false as a valid and registered shell, for login to the system
by txutxu 10y ago
I don't remember the flag, but this could be my answer:
Most linux distributions, come with /bin/false as a valid and registered shell, for login to the system (but it's a program that returns false and does not open a shell).
I know that useradd and adduser allow a flag for change this at creation time (probably --shell /bin/false).
It could be more safe to be explicit since the creation time, than using chsh (changeshell) to avoid race conditions in security, having a user created with a shell until chsh is run.
You see, I didn't remember the flag, but I did try. That's the kind of answer that maybe some interviews are waiting for.
- nailer 10y ago/sbin/nologin actually does some cool logging stuff that /bin/false doesn't, which is why the distros generally use it.
- txutxu 10y agoCool stuff as in display a message that the account cannot login, which leads to brute-force service, process or other stuff system user names. Failed logins will be logged either way. I think still could go with the output of `type -P false`. Unless the project requests that feature of messaging to the (forbidden) user, its forbidden logins. It could work even on embedded devices having only 'false' available.