or just "cheat" and ln -s /sbin/badsh /sbin/nologin
I think that would work too... also need to add /sbin/nologin to /etc/shells