# Ensure nologin is not listed in /etc/shells

Necessity: The `/etc/shells` file contains a list of valid login shells. Including `/sbin/nologin` or `/usr/sbin/nologin` in this file creates a security risk. While `nologin` is designed to prevent interactive logins, some services, such as FTP daemons, consult `/etc/shells` to validate user shells before granting access. If `nologin` is listed as a valid shell, these services might grant access to system or service accounts that are explicitly intended to be non-interactive. This misconfiguration could provide an unintended access vector for an attacker. Removing `nologin` from this file ensures that only legitimate interactive shells are recognized, thereby enforcing the principle of least privilege for non-user accounts.

Auditing and Remediation: The audit script checks the content of the `/etc/shells` file to determine if the path to the `nologin` shell is present. The remediation script modifies the `/etc/shells` file by deleting any lines that contain `/sbin/nologin` or `/usr/sbin/nologin`, effectively revoking its status as a valid login shell.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is `['Not Listed']`. This is a binary security control; there is no secure intermediate state. Including `nologin` in `/etc/shells` is a misconfiguration that directly conflicts with its purpose. Therefore, the only secure configuration is to ensure it is not listed, preventing any service from misinterpreting it as a valid shell and potentially allowing unauthorized access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Listed']` |
| **Moderate** | `['Not Listed']` |
| **Strict** | `['Not Listed']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if '/sbin/nologin' or '/usr/sbin/nologin' is present in the /etc/shells file. The script should output 'Listed' if found and 'Not Listed' if not found. The output must be only the value, with no extra text or formatting.

## Remediation Script Working

bash script that accepts one positional argument: 'Not Listed'. If the argument is 'Not Listed', the script must remove any lines containing '/sbin/nologin' or '/usr/sbin/nologin' from the /etc/shells file. The script should be idempotent, meaning it will not fail if the entry is already absent. The script must return 'true' on successful modification or if no action was needed, and 'false' on any error.

