# Ensure nologin is not listed in /etc/shells

The '/etc/shells' file contains a list of valid login shells. The '/sbin/nologin' and '/usr/sbin/nologin' shells are designed to prevent interactive logins for system or service accounts, typically by printing a message and exiting. Including these paths in '/etc/shells' can create a security vulnerability. Some services, like certain FTP daemons, consult this file to determine if a user has a valid shell before granting access. If 'nologin' is listed as valid, these services might allow a session for a non-interactive account, potentially bypassing security controls and expanding the system's attack surface. The audit script checks for the presence of these 'nologin' paths in the '/etc/shells' file. The remediation script removes these entries to enforce the principle that non-interactive accounts should not have a shell considered valid for login purposes. The recommended state at all security levels (Basic, Moderate, and Strict) is 'Not Listed'. There is no security justification for listing a non-login shell as a valid login shell; its inclusion is always a misconfiguration that weakens system security. Therefore, the only appropriate state is its removal.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Listed']` |
| **Moderate** | `['Not Listed']` |
| **Strict** | `['Not Listed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if '/usr/sbin/nologin' or '/sbin/nologin' is present in the '/etc/shells' file. The script must output 'Listed' if either path is found, and 'Not Listed' otherwise. The output must not contain any other text or labels.

## Remediation Script Working

Bash script that accepts one argument: 'remove'. When executed with this argument, the script must remove any occurrences of '/usr/sbin/nologin' and '/sbin/nologin' from the '/etc/shells' file. The script must output 'true' on successful modification or if the entries were already absent, and 'false' if an error occurs.

