After some more testing I dare to say that this whole /etc/nologin-thing in conjunction with ssh can be considered buggy.
Some users get the contents printed before their session is disconnected, some users don't. To be honest, I don't really care anymore if users get disconnected immediately or get a message before that, what really shouldn't happen is that the root user gets locked out, too. client$ ssh root@server server# echo "NO LOGIN" > /etc/nologin && exit Connection to server closed. client$ ssh root@server NO LOGIN Connection to server closed. Could anybody verify that, please? Regards AndrC)

