0

I've set /etc/nologin to contain a custom message, so when users with the /usr/sbin/nologin shell defined in passwd will try to log in, this custom message will appear on their terminal before throwing them out.

Problem is - this error appears for ALL users, even for root (with /bin/bash defined...)

from the nologin man page:

NAME nologin - prevent unprivileged users from logging into the system

DESCRIPTION If the file /etc/nologin exists and is readable, login(1) will allow access only to root. Other users will be shown the contents of this file and their logins will be refused.

FILES /etc/nologin

Ideas?

Linux mybox02 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
5
  • How does your /etc/passwd look like?
    – Jakuje
    Sep 15, 2016 at 14:01
  • @Jakuje root:x:0:0:root:/root:/bin/bash and blockeduser:x:1339:1339::/home/blockeduser:/usr/sbin/nologin
    – Shai
    Sep 15, 2016 at 14:05
  • What did you change in /etc/ssh/sshd_config?
    – Jakuje
    Sep 15, 2016 at 14:06
  • @Jakuje nothing :[
    – Shai
    Sep 15, 2016 at 14:10
  • can you login at the console as root? Also, if you're using nologin the shell you should put your message into /etc/nologin.txt instead, /etc/nologin will override the shell for non root users--though perhaps for root users via ssh as well. . . I'm not sure about that part Sep 15, 2016 at 15:22

1 Answer 1

2

All is working as expected:

  • The source of /usr/sbin/nologin is very small and easy to check: /usr/sbin/nologin expects no parameter, can't be customised and is not related to /etc/nologin.

  • /etc/nologin is related to /bin/login. so at login the content of /etc/nologin is displayed, but still allows root to login. So root user can know why nobody can login (More than one person can be root, so a coworker will be informed of why an other coworker did it).

For information, the main "user" of /etc/nologin used to be the shutdown command when not used with the "now" parameter (eg: shutdown -r 23:10 "reboot for maintenance") it would put some minutes in advance the /etc/nologin file to prevent users to login before the imminent shutdown. It puts it now in /run/nologin (which is also checked by /bin/login) to avoid problems with a read-only /etc
Then root can still login and run shutdown -c to abort it if needed.

The only "misleading" part is the documentation that while not false, doesn't state that nologin will also be displayed for root.

So you'll have to make a small custom program and put it as shell and better not use a shell interpreted one or somebody will find a way to bypass it (with .profile and alike)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.