When managing a Linux server, you often need to create dedicated user accounts to run specific background services, such as a database or an FTP server. These accounts require specific permissions to access files, but for security reasons, no human being should ever be allowed to log into the terminal using those credentials.
If a hacker manages to guess the password for a service account, they can gain interactive access to your shell. To prevent this, you can assign a specialized “nologin” shell to the user, completely stripping away their ability to log in interactively.
How the nologin Shell Works
Normally, when a user logs into a Linux machine, the operating system assigns them an interactive shell environment (usually /bin/bash).
Linux provides a built-in dummy shell located at /usr/sbin/nologin. When a user is assigned this dummy shell, the system will immediately reject their login attempt, print a polite “This account is currently not available” message, and terminate the connection.
How to Disable Login for an Existing User
If you already have a user account (e.g., named “ftp_user”) and you want to revoke their login access, you must use the usermod command with root privileges.
- Open your terminal and log in as root (or prepare to use
sudo). - Execute the following command, replacing “ftp_user” with the actual username:
sudo usermod -s /usr/sbin/nologin ftp_user
- Press Enter.
The -s flag stands for “shell.” You have successfully overwritten their default bash shell with the nologin binary. The user can no longer connect via SSH or log in from a graphical desktop interface. However, the automated background services running under that username will continue to function perfectly.
How to Create a New User Without Login Access
If you are creating a brand-new service account, you can apply the nologin shell during the initial creation process using the useradd command.
sudo useradd -s /usr/sbin/nologin new_service_user
This creates a highly secure, restricted account from day one, ensuring the credentials cannot be used for interactive terminal access.