In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a selection of lines:daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologingames:x:5:60:games:/usr/games:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologinsyslog:x:101:104::/home/syslog:/bin/falsewhoopsie:x:109:116::/nonexistent:/bin/falsemark:x:1000:1000:mark,,,:/home/mark:/bin/bashConsequently, if I try to swap to any of these users (which I'd sometimes like to do to check my understanding of their permissions, and which there are probably other at least halfway sane reasons for), I fail:mark@lunchbox:~$ sudo su www-dataThis account is currently not available.mark@lunchbox:~$ sudo su syslogmark@lunchbox:~$ Of course, it's not much of an inconvenience, because I can still launch a shell for them via a method like this:mark@lunchbox:~$ sudo -u www-data /bin/bashwww-data@lunchbox:~$ But that just leaves me wondering what purpose is served by denying these users a login shell. Looking around the internet for an explanation, many people claim that this has something to do with security, and everybody seems to agree that it would be in some way a bad idea to change the login shells of these users. Here's a collection of quotes:Setting the Apache user's shell to something non-interactive is generally good security practice (really all service users who don't have to log in interactively should have their shell set to something that's non-interactive).-- https://serverfault.com/a/559315/147556the shell for the user www-data is set to /usr/sbin/nologin, and it's set for a very good reason.-- https://askubuntu.com/a/486661/119754[system accounts] can be security holes, especially if they have a shell enabled:Badbin:x:1:1:bin:/bin:/bin/shGoodbin:x:1:1:bin:/bin:/sbin/nologin-- https://unix.stackexchange.com/a/78996/29001For security reasons I created a user account with no login shell for running the Tomcat server:# groupadd tomcat# useradd -g tomcat -s /usr/sbin/nologin -m -d /home/tomcat tomcat-- http://www.puschitz.com/InstallingTomcat.htmlWhile these posts are in unanimous agreement that not giving system users real login shells is good for security, not one of them justifies this claim, and I can't find an explanation of it anywhere.What attack are we trying to protect ourselves against by not giving these users real login shells?
Does /usr/sbin/nologin as a login shell serve a security purpose?
shell;security;users;login