User & Group Management

Stop your new users from logging into the shell when they only need sftp access

🧩 The Challenge

Setting up a transfer account for a contractor sounds easy until you realize you’ve given them a full interactive shell, allowing them to poke around your server logs and config files. I’ve spent way too much time scrubbing audit trails because I forgot to lock down the login shell.

💡 The Fix

Change their shell to nologin or false to keep them trapped in the directory you’ve designated for them. It saves you from worrying about them running unauthorized commands.

usermod -s /usr/sbin/nologin username

⚙️ Why It Works

Setting the login shell to nologin denies terminal access entirely while still allowing the user to exist in the passwd file for filesystem permissions. Any attempt to ssh into the box will simply get rejected by the server immediately after authentication.

🚀 Pro-Tip: Match this with a ChrootDirectory in your sshd_config to keep them strictly inside their own home folder.

Linux Tips & Tricks | © ngelinux.com | 8/9/2026