I checked for /bin/false as the shell and ! as the leading/only character in the /etc/shadow file. I'll keep checking. I didn't think to try the ALT-F2 login.

I envy you for avoiding the SELinux stuff. It is a major pain to deal with, and conflicts with some of the software we use.