Q: What the hell can you do with nologin?

A: Add /sbin/nologin as the shell to systemaccounts that should never
   get a shell or users that have their account disabled.

   A typical line in /etc/passwd now looks like:

       nobody:x:99:99:nobody:/nonexistant:/sbin/nologin