I don't remember the flag, but this could be my answer:
Most linux distributions, come with /bin/false as a valid and registered shell, for login to the system (but it's a program that returns false and does not open a shell).
I know that useradd and adduser allow a flag for change this at creation time (probably --shell /bin/false).
It could be more safe to be explicit since the creation time, than using chsh (changeshell) to avoid race conditions in security, having a user created with a shell until chsh is run.
You see, I didn't remember the flag, but I did try. That's the kind of answer that maybe some interviews are waiting for.
Cool stuff as in display a message that the account cannot login, which leads to brute-force service, process or other stuff system user names.
Failed logins will be logged either way.
I think still could go with the output of `type -P false`. Unless the project requests that feature of messaging to the (forbidden) user, its forbidden logins.
It could work even on embedded devices having only 'false' available.
Comments
I don't remember the flag, but this could be my answer:
Most linux distributions, come with /bin/false as a valid and registered shell, for login to the system (but it's a program that returns false and does not open a shell).
I know that useradd and adduser allow a flag for change this at creation time (probably --shell /bin/false).
It could be more safe to be explicit since the creation time, than using chsh (changeshell) to avoid race conditions in security, having a user created with a shell until chsh is run.
You see, I didn't remember the flag, but I did try. That's the kind of answer that maybe some interviews are waiting for.
/sbin/nologin actually does some cool logging stuff that /bin/false doesn't, which is why the distros generally use it.
Cool stuff as in display a message that the account cannot login, which leads to brute-force service, process or other stuff system user names.
Failed logins will be logged either way.
I think still could go with the output of `type -P false`. Unless the project requests that feature of messaging to the (forbidden) user, its forbidden logins.
It could work even on embedded devices having only 'false' available.