Ensure accounts without a valid login shell are locked

# Find accounts with nologin/false shell that are not locked
unlocked=""
while IFS=: read -r user _ uid _ _ _ shell; do
  # Skip root and system accounts below UID 1000 that might need special handling
  [ "$user" = "root" ] && continue
  # Check if shell is nologin or false
  if echo "$shell" | grep -qE '(nologin|false)$'; then
    # Check if account is locked (password starts with ! or *)
    passwd_entry=$(grep "^${user}:" /etc/shadow 2>/dev/null | cut -d: -f2)
    if ! echo "$passwd_entry" | grep -qE '^[!*]'; then
      unlocked="$unlocked $user"
    fi
  fi
done < /etc/passwd
if [ -n "$unlocked" ]; then
  echo "FAIL: Accounts with nologin shell not locked:$unlocked"
  exit 1
fi
echo "OK: All nologin accounts are locked"
exit 0

expected_exit:

0

note:

Lock accounts with nologin shell using: passwd -l <username>