From owner-freebsd-security  Mon Jan 20 15:40:26 2003
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 341CA37B401
	for <security@FreeBSD.ORG>; Mon, 20 Jan 2003 15:40:24 -0800 (PST)
Received: from gunjin.wccnet.org (gunjin.wccnet.org [198.111.176.99])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7E07243F5B
	for <security@FreeBSD.ORG>; Mon, 20 Jan 2003 15:40:23 -0800 (PST)
	(envelope-from anthony@gunjin.wccnet.org)
Received: from gunjin.wccnet.org (localhost.rexroof.com [127.0.0.1])
	by gunjin.wccnet.org (8.12.3/8.12.2) with ESMTP id h0KNprgo020799;
	Mon, 20 Jan 2003 18:51:53 -0500 (EST)
Received: (from anthony@localhost)
	by gunjin.wccnet.org (8.12.3/8.12.3/Submit) id h0KNprgA020798;
	Mon, 20 Jan 2003 18:51:53 -0500 (EST)
Date: Mon, 20 Jan 2003 18:51:52 -0500
From: Anthony Schneider <anthony@x-anthony.com>
To: David Schultz <dschultz@uclink.Berkeley.EDU>
Cc: zhuravlev alexander <zaa@ulstu.ru>,
	Oleg Shevtsov <sat@orion.interexc.com>, security@FreeBSD.ORG
Subject: Re: your mail
Message-ID: <20030120235152.GA20708@x-anthony.com>
References: <20030120101323.GA371@interexc.com> <20030120102235.GA45357@hp.ulstu.ru> <20030120225609.GB3668@HAL9000.homeunix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20030120225609.GB3668@HAL9000.homeunix.com>
User-Agent: Mutt/1.4i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

statically linked?  is /sbin/nologin not a shell script anymore?

-Anthony.

On Mon, Jan 20, 2003 at 02:56:09PM -0800, David Schultz wrote:
> Thus spake zhuravlev alexander <zaa@ulstu.ru>:
> > On Mon, Jan 20, 2003 at 12:13:23PM +0200, Oleg Shevtsov wrote:
> > > 
> > > Hi,
> > > how to give specific user FTP but no shell access?
> > > Ftpd's manual says:
> > >            4.   The user must have a standard shell returned by
> > >                 getusershell(3).
> > > But I don't want to give shell account.
> > 
> > 	/sbin/nologin ? 
> 
> If you do it this way, you need to ensure that either the
> ``FTP-only'' users do not have home directories or that
> /sbin/nologin is statically linked (the default).  Otherwise, it
> is possible to exploit a bug (ahem, feature) in OpenSSH to gain
> shell access on your box.
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message