User & Group Management

Stop your service accounts from hoarding stale login shells

🧩 The Challenge

You’ve probably seen it before—a junior dev creates a service account for a web app and gives it /bin/bash, then some scanner flags it because the account is actually logging in over SSH. It’s a massive security hole that takes two seconds to close but usually gets ignored until a pentest report hits your desk.

💡 The Fix

Switch those accounts over to a non-login shell so nobody can spawn an interactive session even if they manage to grab the password. It keeps your audit logs clean and stops unauthorized folks from poking around your environment.

usermod -s /usr/sbin/nologin your_service_account

⚙️ Why It Works

Setting the login shell to nologin effectively tells the system to reject any attempt to start an interactive shell while still allowing the account to own files or run background processes. Modern Linux distributions expect this path, so it won’t break your cron jobs or systemd services.

🚀 Pro-Tip: Use /bin/false if you want to be extra paranoid, but nologin is better since it actually prints a “not permitted” message to the terminal instead of just vanishing.

Linux Tips & Tricks | © ngelinux.com | 8/29/2026