Change a Linux Login Shell Safely with chsh

A wrong login shell can lock you out of your next login, so chsh only lets an ordinary user pick from /etc/shells. You will change the login shell recorded for a Linux account, verify the result, and keep a tested way back if the new shell causes trouble. This guide uses chsh from the Ubuntu passwd package, version 1:4.13+dfsg1-4ubuntu3.2, built from shadow-utils 4.13.

Allow about ten minutes. You need a terminal, the account name you intend to change, and the absolute path of a shell already listed in /etc/shells. Changing your own account normally needs no elevated privilege. Changing another account requires the superuser and should be treated as an account-access change.

1. Record the current shell

Start by recording the account and its current shell. Use your own login name unless you have a specific administrative reason to work on another account:

$ id -un
YOUR_LOGIN
$ getent passwd YOUR_LOGIN
YOUR_LOGIN:x:1000:1000:Your Name:/home/YOUR_LOGIN:/bin/bash

The last field is the current login shell. The other fields are account data, so do not paste the full line into a public issue or chat. Save just the shell path for recovery:

$ OLD_SHELL=$(getent passwd "$(id -un)" | awk -F: '{print $7}')
$ printf 'current shell: %s\n' "$OLD_SHELL"
current shell: /bin/bash

Checkpoint: write down the value printed for current shell. If the change does not suit you, that exact path is the first recovery value to try.

2. Check the allowed shell list

For an ordinary user, chsh accepts a new shell only when its command path appears in /etc/shells. Read the file and choose an exact entry:

$ getent shells
/bin/sh
/usr/bin/sh
/bin/bash
/usr/bin/bash
/bin/rbash
/usr/bin/rbash
/usr/bin/dash
/usr/bin/screen
/usr/bin/tmux
/bin/false

Your list can differ. The file is a policy boundary, not a list of shell packages that should all be installed. Check that the chosen path exists and is executable:

$ NEW_SHELL=/bin/bash
$ test -x "$NEW_SHELL" && printf 'usable: %s\n' "$NEW_SHELL"
usable: /bin/bash

Do not choose a path merely because it looks like a shell. A restricted shell such as /bin/rbash can limit later commands, and /bin/false deliberately refuses interactive logins. The manual specifically warns against changing to a restricted shell unless that is an intentional policy decision.

3. Change your own login shell

Before changing state, confirm the path one more time. The command below changes the account that runs it:

$ printf 'about to set login shell to: %s\n' "$NEW_SHELL"
about to set login shell to: /bin/bash
$ chsh --shell "$NEW_SHELL"
Changing shell for YOUR_LOGIN.
Password:

Enter your account password only into the real terminal prompt. Do not put a password in a script, command line, shell history or article example. Depending on the local PAM configuration, the command may not ask for a password, or it may reject the change even when the shell path is valid.

This command updates the login-shell field for your account. It does not change a terminal that is already running. Open a new login session, or use a login-aware test, before judging the result.

Warning: Do not run this against a production account during an active session unless you have console or another out-of-band recovery route. A shell that cannot start, or one that is too restricted for your normal work, can make ordinary login recovery awkward.

4. Verify the recorded value

Read the account database again rather than inferring success from the command prompt:

$ getent passwd "$(id -un)" | awk -F: '{print $1 ":" $7}'
YOUR_LOGIN:/bin/bash

The printed path should match NEW_SHELL. You can also ask the shell process that is currently running, but that reports the process you already started, not necessarily the shell that a future login will use:

$ printf 'running shell: %s\n' "$SHELL"
running shell: /bin/bash

Checkpoint: the account database is the authoritative check for the next login. The current process can continue using its old shell until it exits.

5. Change another account as an administrator

Use an absolute account name and a shell already permitted by the target system. An ordinary user cannot change another account's login shell:

$ sudo chsh --shell /bin/bash ACCOUNT_NAME
Changing shell for ACCOUNT_NAME.

Replace both placeholders before running the command. sudo elevates the operation; it does not make an invalid shell path safe and does not test whether the target account can use that shell. Verify the target explicitly:

$ getent passwd ACCOUNT_NAME | awk -F: '{print $1 ":" $7}'
ACCOUNT_NAME:/bin/bash

Do not add sudo to your own command as a reflex. The privilege boundary matters: a superuser may set a value that is not in /etc/shells, while an ordinary user may not. That override can create an account that cannot log in as expected, so use it only for a documented administrative requirement and test the resulting access.

6. Use interactive mode when you need to inspect the choice

If you omit --shell, chsh prompts with the current value between square brackets. Type the new absolute path, or press Enter to retain the current shell:

$ chsh
Changing shell for YOUR_LOGIN.
Login Shell [/bin/bash]: /bin/zsh
Password:

Interactive mode is convenient, but it is easier to enter the wrong value or answer a prompt in the wrong terminal. Prefer --shell in reviewed instructions and automation. If you use a shell that is not installed, the next login can fail even if the account field was accepted. Check it before running chsh:

$ command -v zsh
/usr/bin/zsh
$ getent shells | grep -Fx /usr/bin/zsh

If either check produces no output, stop and choose a different listed shell. Do not edit /etc/passwd by hand to repair a mistake. Use chsh with the previously recorded shell instead.

7. Recover from an unsuitable shell

If you can still open a terminal under the account, restore the recorded path:

$ chsh --shell "$OLD_SHELL"
Changing shell for YOUR_LOGIN.

Then verify it with the command from step 4. If the bad shell prevents a normal login, use an existing root shell, a console, or another approved administrative route and restore the account with:

# chsh --shell /bin/bash YOUR_LOGIN
Changing shell for YOUR_LOGIN.

Use the actual path you recorded, not automatically /bin/bash, if the account deliberately used another shell. If the shell binary or its supporting files were removed, restore those through your normal package-management process before attempting another login. The chsh command itself does not install shells.

Common failure messages

Invalid shell. The path is not acceptable for the invoking user, commonly because it is absent from /etc/shells. Check the exact path with getent shells; do not guess a spelling or symlink.
Permission denied. You are changing an account you do not own, or the local authentication policy requires another method. Use the approved administrative route only when you are responsible for that account.
The command succeeded but the current terminal is unchanged. That is expected. Login-shell changes affect future login sessions, not the process that is already running.
A new login immediately closes. Use an out-of-band or administrative shell and restore the previous path. Check that the binary exists, is executable and is a suitable login shell.

Done means

You recorded the previous login shell before changing it.
The new absolute path exists, is executable and is listed by getent shells, unless an intentional superuser policy requires otherwise.
You used ordinary privileges for your own account and elevated privileges only for another account.
getent passwd confirms the intended shell field.
You know the exact command and recovery path to restore the old shell.