Disabling login access to account, nologin,false or null?

which is better for security in order to disable login to an account, setting the shell to false, nologin or null?

is there any difference?

nologin will do. But it will not keep root away.

In case, if you want to restrict some access from remote, use ssh and u can even block root access thro' ssh.

oh yeah? I bet false will keep even root out, not that you'd want to blow your own foot off like that though...

I believe the best option would be to allow the user to change his password without giving him login access. try this

shell= /bin/passwd