1

I've set /etc/nologin to contain a custom message, so when users with the /usr/sbin/nologin shell defined in passwd will try to log in, this custom message will appear on their terminal before throwing them out.

Problem is - this error appears for ALL users, even for root (with /bin/bash defined...)

from the nologin man page:

NAME nologin - prevent unprivileged users from logging into the system

DESCRIPTION If the file /etc/nologin exists and is readable, login(1) will allow access only to root. Other users will be shown the contents of this file and their logins will be refused.

FILES /etc/nologin

Ideas?

Linux mybox02 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
5
  • How does your /etc/passwd look like?
    – Jakuje
    Sep 15, 2016 at 14:01
  • @Jakuje root:x:0:0:root:/root:/bin/bash and blockeduser:x:1339:1339::/home/blockeduser:/usr/sbin/nologin
    – Shai
    Sep 15, 2016 at 14:05
  • What did you change in /etc/ssh/sshd_config?
    – Jakuje
    Sep 15, 2016 at 14:06
  • @Jakuje nothing :[
    – Shai
    Sep 15, 2016 at 14:10
  • can you login at the console as root? Also, if you're using nologin the shell you should put your message into /etc/nologin.txt instead, /etc/nologin will override the shell for non root users--though perhaps for root users via ssh as well. . . I'm not sure about that part Sep 15, 2016 at 15:22

1 Answer 1

3

All is working as expected:

  • The source of /usr/sbin/nologin is very small and easy to check: /usr/sbin/nologin expects no parameter, can't be customised and is not related to /etc/nologin.

  • /etc/nologin is related to /bin/login. so at login the content of /etc/nologin is displayed, but still allows root to login. So root user can know why nobody can login (More than one person can be root, so a coworker will be informed of why an other coworker did it).

For information, the main "user" of /etc/nologin used to be the shutdown command when not used with the "now" parameter (eg: shutdown -r 23:10 "reboot for maintenance") it would put some minutes in advance the /etc/nologin file to prevent users to login before the imminent shutdown. It puts it now in /run/nologin (which is also checked by /bin/login) to avoid problems with a read-only /etc
Then root can still login and run shutdown -c to abort it if needed.

The only "misleading" part is the documentation that while not false, doesn't state that nologin will also be displayed for root.

So you'll have to make a small custom program and put it as shell and better not use a shell interpreted one or somebody will find a way to bypass it (with .profile and alike)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .