Date: Tue, 24 Feb 2004 19:10:43 -0500 From: Lanny Baron <lnb@FreeBSDsystems.COM> To: kientzle@acm.org Cc: Colin Percival <colin.percival@wadham.ox.ac.uk> Subject: Re: What to do about nologin(8)? Message-ID: <403BE803.40606@FreeBSDsystems.COM> In-Reply-To: <403BE4BC.9070009@kientzle.com> References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca> <20040224223659.GB69570@VARK.homeunix.com> <6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca> <403BE4BC.9070009@kientzle.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi,
What I have done in the past for preventing logins via telnet/ssh is to
make a script called ftponly and put it in /usr/local/bin and in
/etc/shells put a line as /usr/local/bin/ftponly
The little script for /usr/local/bin/ftponly is:
#!/bin/sh -p
echo 'This account is currently available only for FTP access.'
exit 1
Of course when you run adduser or pw useradd, you will choose
/usr/local/bin/ftponly as their shell.
Regards,
Lanny
Tim Kientzle wrote:
> Colin Percival wrote:
>
>> At 22:36 24/02/2004, David Schultz wrote:
>>
>>> (1) Fix login(1) so that it disables the -p option when the target
>>> user's shell is not in /etc/shells (unless the invoking user
>>> is root)
>>
>>
>> Adding /sbin/nologin to /etc/shells is a standard way to create
>> ftp-only users.
>
>
> Putting /sbin/nologin as the user's shell in /etc/passwd is
> quite standard, yes, for exactly the reason you describe.
>
> Adding it to /etc/shells is a very different matter, though.
> My understanding has always been that /etc/shells is intended to
> list the "standard" *interactive* user shells. Special or
> restricted shells should not be listed there.
>
> In particular, /sbin/nologin should certainly not be in /etc/shells.
>
> chpass(1) has some comments on this. getusershell(3) and
> shells(5) are admittedly pretty vague. Perhaps some
> manpage-tuning is in order.
>
>>> (2) Make nologin(8) setgid nobody, so rtld ignores LD_LIBRARY_PATH.
>>
>>
>> Wearing my member-of-security-team hat, I have to say I'm rather
>> unhappy with this idea. It's also been pointed out (by nectar) that
>> there are issues with NFS if files are owned by nobody or nogroup.
>
>
> Even though I tossed it out as an option, I'm uncomfortable
> with it as well just on the "unnecessary setgid" principle.
>
> My preference at the moment is for nologin(8):
> * to be statically linked so it cannot easily be trojaned
> * to throw out the current environment and create a clean
> environment from scratch before invoking system("logger...")
> to perform any logging.
>
> This would keep the size of nologin(8) down while keeping
> it pretty safe.
>
> Tim Kientzle
>
> _______________________________________________
> freebsd-current@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
Lanny Baron
Proud to be 100% FreeBSD
http://www.FreeBSDsystems.COM
Toll Free: 1.877.963.1900
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?403BE803.40606>