From owner-freebsd-security Fri Mar 22 12:37:22 2002 Delivered-To: freebsd-security@freebsd.org Received: from slc.edu (weir-01c.slc.edu [207.106.89.46]) by hub.freebsd.org (Postfix) with ESMTP id CF07E37B41A for ; Fri, 22 Mar 2002 12:37:14 -0800 (PST) Received: (from anthony@localhost) by slc.edu (8.11.1/8.11.1) id g2MKav203645; Fri, 22 Mar 2002 15:36:57 -0500 (EST) (envelope-from anthony) Date: Fri, 22 Mar 2002 15:36:57 -0500 From: Anthony Schneider To: Fernan Aguero Cc: FreeBSD Security Subject: Re: su -c user command not working Message-ID: <20020322153657.A3593@mail.slc.edu> References: <20020322165816.A561@iib.unsam.edu.ar> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="oyUTqETQ0mS9luUI" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20020322165816.A561@iib.unsam.edu.ar>; from fernan@iib.unsam.edu.ar on Fri, Mar 22, 2002 at 04:58:17PM -0300 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --oyUTqETQ0mS9luUI Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable the -c flag passes a command to the shell of the user you are su'ing to, so since user man's shell is /sbin/nologin, /sbin/nologin is (according to su) supposed to interpret the command 'catman' and execute it, however /sbin/nologin doesn't interpret commands, it just prints the message "This account is currently unavailable" (just as it did for you) and then exits. for 'su -c' to work, the user you are su'ing to needs something to actually interpret the command. i suggest you either change that user's passwd info to have such a shell, or you to an account that has such a shell. as for xterm reading your .cshrc, you need to pass it the option -ls,=20 which tells it to launch a login shell. -Anthony. On Fri, Mar 22, 2002 at 04:58:17PM -0300, Fernan Aguero wrote: > I wonder if this is security related.=20 >=20 > Basically I'd like to know if this has been disabled for security > reasons. >=20 > According to su(1) you can do something like:=20 > su man -c catman > Runs the command catman as user man. You will be asked for man's > password unless your real UID is 0. > =09 > However, I am refused to run the example in this way (I am root, of=20 > course).=20 >=20 > root> su man -c catman > This account is currently not available. >=20 > man is listed in /etc/passwd with /sbin/nologin as shell >=20 > I'd also like to know why my ~/.cshrc is not read when I log in or > open an xterm. I have to source it every time. Is this also related to > the previous issue (disabled for some reason?) >=20 > I am running FreeBSD-4.3 (RELENG_4_3), and except for some minor > things haven't done major configuration or editing of system base > defaults. >=20 > Thanks in advance for any help or pointers, >=20 > Fernan >=20 > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message ----------------------------------------------- PGP key at: http://www.keyserver.net/ http://www.anthonydotcom.com/gpgkey/key.txt Home: http://www.anthonydotcom.com ----------------------------------------------- --oyUTqETQ0mS9luUI Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjyblekACgkQ+rDjkNht5F0jPQCfXnC3F/2P5GhhJl4Gsqyro8ko qCUAnR+fL4F2CJorzOPZihR5d16ewe3d =7DOs -----END PGP SIGNATURE----- --oyUTqETQ0mS9luUI-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message