Date: Sun, 22 Feb 2004 22:06:16 -0800 From: Tim Kientzle <tim@kientzle.com> To: David Schultz <das@FreeBSD.ORG> Cc: Colin Percival <cperciva@FreeBSD.ORG> Subject: Re: cvs commit: src/sbin/nologin Makefile nologin.c Message-ID: <40399858.8060506@kientzle.com> In-Reply-To: <20040223052110.GA58255@VARK.homeunix.com> References: <200402221003.i1MA3PW0024791@repoman.freebsd.org> <403944D8.6050107@kientzle.com> <20040223025647.GA43467@VARK.homeunix.com> <40397824.3080607@kientzle.com> <20040223052110.GA58255@VARK.homeunix.com>
next in thread | previous in thread | raw e-mail | index | archive | help
David Schultz wrote: > > One unfortunate side-effect [of dynamic /bin is that] custom > versions of nologin that people have written as shell scripts are > now insecure. Is there any reason why "login -p" should be permitted if the user's shell is not listed in /etc/shells ? chpass already enforces a clear distinction between "standard" and "non-standard" shells. It seems reasonable for login(1) to also be aware of that distinction. Tim
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?40399858.8060506>