UNIX for Dummies Questions & Answers

Is it possible to SSH with an account that has its shell set to /sbin/nologin?

The reason I ask is because I am running an instance of nagios where I need to use SSH keys to run a check, but I am getting connect errors in Nagios. Also, what is the risk I run into if I just simply change my nagios user's shell from nolgin to /sbin/bash
is this not recommended?

Thanks

You can't login to ssh with an account set to nologin, no. That's kind of the point.

Actually now that I think of it you can install a utility called 'scponly', which is a special "shell" which will allow users to login for scp/sftp but won't permit them to login to a shell session. This would have the security advantages of nologin, but still let you check keys by logging in with scp.

YES !

You CAN ssh from a a nologin account (such as daemon, apache, tomcat, ect..). The only thing you have to do is:
1 - Create global known_hosts file at /etc/ssh/ssh_known_hosts
2 - Change it's permission to 644. Note: NOT 600. Other people need to read it.
4 - Put destination host key into this file.
5 - Create a RSA keypair then add id_rsa.pub to destination account (if you use password, try yourself).
==> you can use ssh to run command remotely.
I created a PHP page (run by daemon user on system) to execute command by another user at another machine, of course using SSH.