Ansible equivalent of "passwd -l"

Question

I'm trying to lock a user account that I just created with Ansible (it should not be possible to log into this account). I know you can do this using the shell module by running "passwd -l".

Is there a way to do this via the user module, or something similar?

Answer 1

I think that's not possible.

Maybe the following is an option?

 - user: 
     name: someone
     shell: /sbin/nologin

I think this is even more secure than using passwd -l as the latter would only disable the password. The user would still be able to login by ssh key authentication.