Do not list nologin as a valid shell

Description

/etc/shells lists the valid login shells. Some programs, like chsh and FTP servers, use it to decide whether an account may log in. nologin exists precisely to refuse logins and must not appear there.

Rationale

Listing nologin makes service accounts look like regular users to programs that rely on /etc/shells, which can open them to FTP logins or let users switch to it and back.

Impact

None known. Debian does not list it by default.

Audit

Run grep nologin /etc/shells. There must be no match.

Automated: every check must pass. Scanners report each check by its id.

shells

path: /etc/shells
pattern: nologin
expect: no_match

Remediation

Remove the nologin lines from /etc/shells.

remove

cb_backup /etc/shells
sed -i '/nologin/d' /etc/shells

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• shells(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle