--- name: "pam_nologin" section: "8" platform: "linux" package: "pam" version: "1.7.3-1" release: "Arch Linux 2026-11-01" platforms: ["linux", "freebsd", "macos"] url: "https://new.carta.tech/pam_nologin" --- # pam\_nologin(8) Prevent non-root users from login ## NAME pam\_nologin - Prevent non-root users from login ## SYNOPSIS **pam\_nologin.so** \[file=*/path/nologin*\] \[successok\] ## DESCRIPTION pam\_nologin is a PAM module that prevents users from logging into the system when /var/run/nologin or /etc/nologin exists. The contents of the file are displayed to the user. The pam\_nologin module has no effect on the root user's ability to log in. ## OPTIONS file=/path/nologin Use this file instead the default /var/run/nologin or /etc/nologin. successok Return PAM\_SUCCESS if no file exists, the default is PAM\_IGNORE. ## MODULE TYPES PROVIDED The **auth** and **account** module types are provided. ## RETURN VALUES PAM\_AUTH\_ERR The user is not root and /etc/nologin exists, so the user is not permitted to log in. PAM\_BUF\_ERR Memory buffer error. PAM\_IGNORE This is the default return value. PAM\_SUCCESS Success: either the user is root or the nologin file does not exist. PAM\_USER\_UNKNOWN User not known to the underlying authentication module. ## EXAMPLES The suggested usage for /etc/pam.d/login is: ``` auth required pam_nologin.so ``` ## NOTES In order to make this module effective, all login methods should be secured by it. It should be used as a *required* method listed before any *sufficient* methods in order to get standard Unix nologin semantics. Note, the use of **successok** module argument causes the module to return *PAM\_SUCCESS* and as such would break such a configuration - failing *sufficient* modules would lead to a successful login because the nologin module *succeeded*. ## SEE ALSO [**nologin**(5)](/nologin/5.md), [**pam.conf**(5)](/pam.conf/5.md), [**pam.d**(5)](/pam.d/5.md), [**pam**(8)](/pam/8.md) ## AUTHOR pam\_nologin was written by Michael K. Johnson \.