nerdexam
IBM

000-221 · Question #122

Which action will temporarily disable remote login access using telnet and ssh for all non-root accounts?

The correct answer is C. Create a/etc/nologin file. The presence of /etc/nologin on a Unix/Linux system instructs login utilities to reject all non-root login attempts, covering both SSH and telnet sessions without requiring service restarts.

Security

Question

Which action will temporarily disable remote login access using telnet and ssh for all non-root accounts?

Options

  • AUpdate /etc/security/passwd and recycle the inetd subsystem.
  • BStop the sshd subsystem.
  • CCreate a/etc/nologin file.
  • DSet the PermitLogins parameter in /etc/ssh/sshd_config and recycle the sshd daemon.
  • ETouch the /etc/sshd/nologin file and recycle the sshd daemon.

How the community answered

(23 responses)
  • B
    9% (2)
  • C
    70% (16)
  • D
    4% (1)
  • E
    17% (4)

Why each option

The presence of /etc/nologin on a Unix/Linux system instructs login utilities to reject all non-root login attempts, covering both SSH and telnet sessions without requiring service restarts.

AUpdate /etc/security/passwd and recycle the inetd subsystem.

Editing /etc/security/passwd and recycling inetd affects password authentication records but does not create a universal login block for non-root users across all services.

BStop the sshd subsystem.

Stopping sshd only disables SSH logins and has no effect on telnet or other login vectors, so access is not fully blocked.

CCreate a/etc/nologin file.Correct

When /etc/nologin exists, the PAM login stack and SSH daemon both check for this file and immediately refuse login for any non-root user, displaying the file contents as the rejection message. This mechanism is built into the login subsystem and intercepts sessions before shell access is granted. It is the standard, temporary method to block all non-root remote logins system-wide.

DSet the PermitLogins parameter in /etc/ssh/sshd_config and recycle the sshd daemon.

There is no PermitLogins directive in sshd_config; the relevant SSH directives are AllowUsers or DenyUsers, and this approach would only affect SSH, not telnet.

ETouch the /etc/sshd/nologin file and recycle the sshd daemon.

The nologin file must reside at /etc/nologin to be recognized by standard login utilities; /etc/sshd/nologin is not a valid path for this purpose.

Concept tested: Using /etc/nologin to block non-root logins

Source: https://man7.org/linux/man-pages/man5/nologin.5.html

Topics

#nologin#remote access control#telnet#SSH restriction

Community Discussion

No community discussion yet for this question.

Full 000-221 Practice