If you change the shell to nologin or any such non-existent shells, you have to update /etc/shells with it and do a usermod -s /bin/nologin oracle . That will prevent any login whatsoever, including su, since you will get a "no shell" error. If, however, you only want to lock the ID...