Nobody can log in as deploy

The service user deploy keeps the built releases in its home directory, and releases go out as that user: sudo su - deploy -c /opt/deploy/publish.sh. Today that command refused for the first time. Somebody was tidying up user accounts yesterday, there is nobody around to ask who touched what, and the release is due by noon.

The symptom

The user is there, but no way into its account works. Two tools refuse in two different ways.

$ id deploy
uid=1500(deploy) gid=1500(deploy) groups=1500(deploy)

$ sudo su - deploy -c /opt/deploy/publish.sh
Your account has expired; please contact your system administrator.
su: Authentication failure

$ sudo -iu deploy id
This account is currently not available.

The second command is the same login through another tool: -u deploy picks the user, -i starts that user's login shell. The messages differ. One account, two tools, two different refusals: more than one mechanism is keeping you out.

What you have to end up with

Five conditions, and the system checks them inside your own container. sudo su - deploy -c /opt/deploy/publish.sh prints the line about release 5.12 as deploy. deploy has a real login shell: the one written in getent passwd is listed in /etc/shells, and the /usr/sbin/nologin program is still a regular file. The deploy