I deploy web applications by "sandboxing" each application under its own UNIX user account, behind a common nginx reverse proxy that also serves static files. Each account runs the application server, to which nginx will forward requests via fcgi. Each user's home folder hosts the application code and static files, which of course need to be readable by nginx.

I'm trying to secure this setup as much as possible, and /bin/false came up while reading up on the topic.

If I was to set the application user's shell to /bin/false, what would I gain, in terms of security?


This question may be relevant: https://unix.stackexchange.com/questions/28888/why-does-the-bin-user-need-a-login-shell.

In general, one thing you gain by using /bin/false (or preferrably, /sbin/nologin) is for login attempts to fail, even in a situation where it would otherwise have been permitted. This is covered in more detail by, for example, https://www.digitalocean.com/community/tutorials/how-to-restrict-log-in-capabilities-of-users-on-ubuntu.

It is therefore one part of defending against account abuse/brute forcing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.