Of the ways listed, which is the best way to temporarily suspend a single user's ability to interactively login?

The `/etc/nologin` file prevents *all* non-root users from logging in with a specific message, making it a system-wide lock, not a method for a single user.

Changing the user's password prevents them from logging in, but it's not a "temporary suspension" in the sense that their password is now different. It requires another password change to restore access, which is less graceful than an expiration date.

Changing the user name in `/etc/passwd` would corrupt the user's account and is not a temporary suspension method; it would effectively disable the account entirely in an ungraceful way.

Using the `chage` command to set an immediate or past account expiration date (`chage -E YYYY-MM-DD username`) is an effective and easily reversible method to temporarily prevent a specific user from interactively logging in. Once the account is expired, login attempts will be denied until the expiration date is updated.

Placing `logout` in a user's profile script would allow them to log in briefly before being logged out, which is not a complete suspension of their ability to interactively log in and can potentially be bypassed.