Date: Tue, 24 Feb 2004 15:56:44 -0800 From: Tim Kientzle <tim@kientzle.com> To: Colin Percival <colin.percival@wadham.ox.ac.uk> Cc: freebsd-current@freebsd.org Subject: Re: What to do about nologin(8)? Message-ID: <403BE4BC.9070009@kientzle.com> In-Reply-To: <6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca> References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca> <20040224223659.GB69570@VARK.homeunix.com> <6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca>
index | next in thread | previous in thread | raw e-mail
Colin Percival wrote:
> At 22:36 24/02/2004, David Schultz wrote:
>
>> (1) Fix login(1) so that it disables the -p option when the target
>> user's shell is not in /etc/shells (unless the invoking user
>> is root)
>
> Adding /sbin/nologin to /etc/shells is a standard way to create
> ftp-only users.
Putting /sbin/nologin as the user's shell in /etc/passwd is
quite standard, yes, for exactly the reason you describe.
Adding it to /etc/shells is a very different matter, though.
My understanding has always been that /etc/shells is intended to
list the "standard" *interactive* user shells. Special or
restricted shells should not be listed there.
In particular, /sbin/nologin should certainly not be in /etc/shells.
chpass(1) has some comments on this. getusershell(3) and
shells(5) are admittedly pretty vague. Perhaps some
manpage-tuning is in order.
>> (2) Make nologin(8) setgid nobody, so rtld ignores LD_LIBRARY_PATH.
>
> Wearing my member-of-security-team hat, I have to say I'm rather
> unhappy with this idea. It's also been pointed out (by nectar) that
> there are issues with NFS if files are owned by nobody or nogroup.
Even though I tossed it out as an option, I'm uncomfortable
with it as well just on the "unnecessary setgid" principle.
My preference at the moment is for nologin(8):
* to be statically linked so it cannot easily be trojaned
* to throw out the current environment and create a clean
environment from scratch before invoking system("logger...")
to perform any logging.
This would keep the size of nologin(8) down while keeping
it pretty safe.
Tim Kientzle
home |
help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?403BE4BC.9070009>