Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 20 Jan 2003 16:24:28 -0800
From:      "Crist J. Clark" <crist.clark@attbi.com>
To:        Anthony Schneider <anthony@x-anthony.com>
Cc:        David Schultz <dschultz@uclink.Berkeley.EDU>, zhuravlev alexander <zaa@ulstu.ru>, Oleg Shevtsov <sat@orion.interexc.com>, security@FreeBSD.ORG
Subject:   Re: your mail
Message-ID:  <20030121002428.GF34751@blossom.cjclark.org>
In-Reply-To: <20030120235152.GA20708@x-anthony.com>
References:  <20030120101323.GA371@interexc.com> <20030120102235.GA45357@hp.ulstu.ru> <20030120225609.GB3668@HAL9000.homeunix.com> <20030120235152.GA20708@x-anthony.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jan 20, 2003 at 06:51:52PM -0500, Anthony Schneider wrote:
> statically linked?  is /sbin/nologin not a shell script anymore?

It is, but it invokes /bin/sh which is static and calls it with
'-p'.

> On Mon, Jan 20, 2003 at 02:56:09PM -0800, David Schultz wrote:
> > Thus spake zhuravlev alexander <zaa@ulstu.ru>:
> > > On Mon, Jan 20, 2003 at 12:13:23PM +0200, Oleg Shevtsov wrote:
> > > > 
> > > > Hi,
> > > > how to give specific user FTP but no shell access?
> > > > Ftpd's manual says:
> > > >            4.   The user must have a standard shell returned by
> > > >                 getusershell(3).
> > > > But I don't want to give shell account.
> > > 
> > > 	/sbin/nologin ? 
> > 
> > If you do it this way, you need to ensure that either the
> > ``FTP-only'' users do not have home directories or that
> > /sbin/nologin is statically linked (the default).  Otherwise, it
> > is possible to exploit a bug (ahem, feature) in OpenSSH to gain
> > shell access on your box.

-- 
Crist J. Clark                     |     cjclark@alum.mit.edu
                                   |     cjclark@jhu.edu
http://people.freebsd.org/~cjc/    |     cjc@freebsd.org

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030121002428.GF34751>