tcpdump (arpwatch) adds a pcap user to /etc/passwd with a shell of /bin/nologin, which doesn't even exist. The correct shell is /sbin/nologin
*** This bug has been marked as a duplicate of 58346 ***