≡ Menu

Howto: Linux shell restricting access

By default when you add new user to system (/etc/passwd file) it grant shell access. If you are creating new users for POP3 or SMTP (mail server) or FTP then you do not need to grant shell access to a user. Remember as soon as you add a user he/she can login via telnet or ssh. The best way to put Linux shell access restriction is to use special shell called nologin, which politely refuse a login. It displays a message that an account is not available and exits non-zero. It is intended as a replacement shell field for accounts that have been disabled or have other user level access such as ftp, pop3, smtp etc. This is a very common practice followed by ISP or web hosting service provider's web, mail and FTP server(s).

/sbin/nologin Example

(a) First make sure nologin exists in /etc/shells file (else service such as ftp may not allow login)
# less /etc/shells
If nologin shell does not exist in above shell list, just add /sbin/nologin shell to it:
# echo "/sbin/nologin" >> /etc/shells
If you are using Debian then use following path:
# echo "/usr/sbin/nologin" >> /etc/shells
(b) Block shell access for user vivek (vivek user account must exits):
# usermod -s /sbin/nologin vivek
Debain Linux user modify above command as follows:
# usermod -s /usr/sbin/nologin vivek
Now user vivek's new login shell is /sbin/nologin. Vivek allowed to use other services such as ftp, pop3 but not shell access via ssh or telnet.

New user accounts

Add a new user called tony with no shell access:
# useradd -s /sbin/nologin tony
Debain / Ubuntu Linux user modify above command as follows:
# useradd -s /usr/sbin/nologin tony

Please note that above method is very easy to use but if you have a large setup. you need to take help of PAM (and may be OpenLDAP / MySQL). I will cover such setup some time later :).

Tweet itFacebook itGoogle+ itPDF itFound an error/typo on this page?

Comments on this entry are closed.

  • mantizke May 12, 2009, 7:32 pm

    this does not work for me on debian system. however, nologin exist but the command did not work :( (user CAN still login via ssh)

  • Lekensteyn May 14, 2010, 4:24 pm

    Mantizke, you control that in /etc/ssh/sshd_config:

    AllowUsers user

    in this case, only user may login and all other users are denied access.

  • tony August 31, 2011, 6:09 pm

    I protest. This article is prejudiced against Tony.

    I WANT MY BASH ACCESS!

    (Really, thanks. I was looking for a way to make an ftp user with no shell access on a debian box. This was precisely what I needed.)

  • WhoA November 30, 2012, 12:06 am

    Man!You save my day! Thank you very-very much for this usefull post.
    At least i learned new security measure how to separate UID’s on my test webserver.
    God Bless You.

  • moncasi August 7, 2013, 11:42 am

    Isn’t it the same than creating a new user with
    adduser –disabled-login USER
    ?
    Thanks

  • ben September 24, 2013, 10:00 pm

    if you just want to get a new real user try “adduser –help” for normal user it should be the option “–disabled-login” or maybe you want to create a system user try “adduser –system –no-create-home USER”.

  • Manuel January 19, 2014, 6:58 pm

    adduser --disabled-login is **NOT** the right thing to use for blocking shell access!!

    Enter “man adduser” and look for this description:

           --disabled-login
                  Do  not  run passwd to set the password.  The user won't be able
                  to use her account until the password is set.
    
  • Geo February 18, 2014, 1:38 pm

    Hi,

    Can someone tell me what is ” /s$ ” in /etc/passwd file instead of /sbin/nologin ?

    someuser:x:1022:1022::System User for someuser:/home/someuser/:/s$

    Thank You

    • Leo February 18, 2014, 4:25 pm

      /s$ that is an unusual shell name. I hope you are not hacked. Is someuser was created by you?

      • Geo February 18, 2014, 5:33 pm

        Yes, the “someuser” was crated by me for some time.. I searched on google but I didn’t find any answer… about /s$.
        And is true, this think is on a hacked server… by a rootkit — SHV4 or SHV5. and I want to see how was hacked…

        Thank You!