How do you create a service account for an application, and what do useradd -r and -s /sbin/nologin do?

Create a system group and a system user (-r) whose login shell is /sbin/nologin, so the account can own and run the service but nobody can log in with it.

sudo groupadd -r myappgroup
sudo useradd -r -s /sbin/nologin -g myappgroup myappuser
id myappuser

• -r creates a system account: its UID comes from the system range (below 1000), it gets no home directory by default, and its password does not expire.
• -s /sbin/nologin sets the login shell to a program that refuses the login. Anyone who tries gets "This account is currently not available."
• -g myappgroup sets the primary group.

/sbin/nologin or /bin/false? Both block an interactive login. /bin/false just exits with an error code and says nothing, while nologin prints a clear message and is the documented choice for service accounts. Neither shell is used when a service manager starts the service directly, so the application still runs.

The point is least privilege: if the application is compromised, the attacker holds an account that owns only the application's files and cannot be used to log in.

Go deeper:

• man7.org: useradd(8) — the -r, -s and -g options.
• man7.org: nologin(8) — what nologin prints and how it differs from false.