Date: Wed, 10 Dec 2008 13:57:26 -0500 (EST) From: "Dan Mahoney, System Admin" <danm@prime.gushi.org> To: Dan Nelson <dnelson@allantgroup.com> Cc: questions@freebsd.org Subject: Re: How to block NIS logins via ssh? Message-ID: <alpine.BSF.2.00.0812101347010.2179@prime.gushi.org> In-Reply-To: <20081210160222.GB82227@dan.emsphone.com> References: <alpine.BSF.2.00.0812100440400.49382@prime.gushi.org> <20081210160222.GB82227@dan.emsphone.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 10 Dec 2008, Dan Nelson wrote: > In the last episode (Dec 10), Dan Mahoney, System Admin said: >> I'm noticing that when following the directions given here: >> >> http://www.freebsd.org/doc/en/books/handbook/network-nis.html >> >> For how to disable logins, the recommended action is to set the shell to >> /sbin/nologin. >> >> However, this is sloppy as it allows the user to log in, get the >> motd, do everything short of getting a shell. >> >> I've tried starring out the password in the +::::::::: entry, (and >> putting in a "bad" password, like x), and those don't seem to work. >> I am still able to connect via sshd and prove that the account works. > > By default, the passwd field is ignored in an NIS + or - line. It looks > like if you rebuild libc with PW_OVERRIDE_PASSWD=1, you will get the > behaviour you're looking for (see the compat_set_template function in > src/lib/libc/gen/getpwent.c). Okay, let's look at it from an alternate tack then -- what else renders an account invalid? Is there a pam knob to check /etc/shells? Or an sshd option? I found these: http://osdir.com/ml/linux.admin.managers/2003-08/msg00016.html for a user who had a similar problem, but freebsd doesn't appear to have the requisite module. This could also be implemented as an option to pam_unix (which could check either /etc/shells or the NIS equivalent, since it already has the NIS hooks.) I'll make a separate post to -hackers requesting this. it's probably pretty trivial to port, but I'm leery to do so not-being a c-coder. -Dan -- "Of course she's gonna be upset! You're dealing with a woman here Dan, what the hell's wrong with you?" -S. Kennedy, 11/11/01 --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.00.0812101347010.2179>