fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.

debian-package/src/usr/lib/vpn-router/setup

@@ -555,8 +555,8 @@ def manage_console(cfg):
 
     The local group vpnrouter_ldap.CONSOLE_GROUP is created when missing, and sudo lets its members run any command
     with their password. nslcd serves the directory's posixAccounts with console login on through the local socket,
-    and checks their passwords by binding as the user; the passwd line of the name service switch gains ldap, and PAM
-    creates a home at the first login. While ssh.ldap_login is true, sshd accepts the password of the group's members;
+    and checks their passwords by binding as the user; the passwd line of the name service switch gains ldap, which
+    restarts the web service, and PAM creates a home at the first login. While ssh.ldap_login is true, sshd accepts the password of the group's members;
     a drop-in sshd -t refuses is removed again.
     """
     group = vpnrouter_ldap.CONSOLE_GROUP
@@ -601,6 +601,9 @@ def manage_console(cfg):
                     for line in lines]
         if switched != lines:
             NSSWITCH.write_text(''.join(switched), encoding='utf-8')
+            # A running process keeps the name service switch it read first, so the web service's shell would not find
+            # the console accounts of the directory until it restarts.
+            run(['systemctl', 'try-restart', 'vpn-router-web.service'], check=False)
 
         if 'pam_mkhomedir' not in PAM_SESSION.read_text(encoding='utf-8'):
             run(['pam-auth-update', '--enable', 'mkhomedir'], check=False)