Use PAM nologin to disable Linux Logins (#20699)

#20370

changes/20370-linux-nologin

@@ -0,0 +1 @@
+- Linux lock/unlock scripts now make use of pam_nologin to keep AD users locked out

ee/server/service/embedded_scripts/linux_lock.sh

@@ -29,4 +29,15 @@ do
     fi
 done
 
+# Logout any non-passwd users
+logged_in=$(users | tr ' ' '\n' | sort  | uniq)
+for user in $logged_in; do
+    [ "$user" = "root" ] && continue
+    echo "Logging out $user"
+    pkill -KILL -u "$user"
+done
+
+# Create the pam_nologin file
+touch /etc/nologin
+
 echo "All non-root users have been logged out and their accounts locked."

ee/server/service/embedded_scripts/linux_unlock.sh

@@ -19,3 +19,6 @@ do
         fi
     fi
 done
+
+# Remove the pam_nologin file
+rm /etc/nologin

scripts/mdm/linux/linux-lock.sh

@@ -29,4 +29,15 @@ do
     fi
 done
 
+# Logout any non-passwd users
+logged_in=$(users | tr ' ' '\n' | sort  | uniq)
+for user in $logged_in; do
+    [ "$user" = "root" ] && continue
+    echo "Logging out $user"
+    pkill -KILL -u "$user"
+done
+
+# Create the pam_nologin file
+touch /etc/nologin
+
 echo "All non-root users have been logged out and their accounts locked."

scripts/mdm/linux/linux-unlock.sh

@@ -19,3 +19,6 @@ do
         fi
     fi
 done
+
+# Remove the pam_nologin file
+rm /etc/nologin