From owner-freebsd-current@FreeBSD.ORG Tue Feb 24 16:10:58 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 23B8E16A4CE for ; Tue, 24 Feb 2004 16:10:58 -0800 (PST) Received: from mx1.freebsdsystems.com (mx1.FreeBSDsystems.COM [216.138.197.66]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8351143D2D for ; Tue, 24 Feb 2004 16:10:57 -0800 (PST) (envelope-from lnb@FreeBSDsystems.COM) Received: (qmail 88518 invoked by uid 0); 25 Feb 2004 00:10:06 -0000 Received: from unknown (HELO FreeBSDsystems.COM) (lnb@216.235.8.115) by 216.138.197.66 with SMTP; 25 Feb 2004 00:10:06 -0000 Message-ID: <403BE803.40606@FreeBSDsystems.COM> Date: Tue, 24 Feb 2004 19:10:43 -0500 From: Lanny Baron Organization: Freedom Technologies Corporation User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6b) Gecko/20031205 Thunderbird/0.4 X-Accept-Language: en-us, en MIME-Version: 1.0 To: kientzle@acm.org References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca> <20040224223659.GB69570@VARK.homeunix.com> <6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca> <403BE4BC.9070009@kientzle.com> In-Reply-To: <403BE4BC.9070009@kientzle.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: David Schultz cc: freebsd-current@freebsd.org cc: Colin Percival Subject: Re: What to do about nologin(8)? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Feb 2004 00:10:58 -0000 Hi, What I have done in the past for preventing logins via telnet/ssh is to make a script called ftponly and put it in /usr/local/bin and in /etc/shells put a line as /usr/local/bin/ftponly The little script for /usr/local/bin/ftponly is: #!/bin/sh -p echo 'This account is currently available only for FTP access.' exit 1 Of course when you run adduser or pw useradd, you will choose /usr/local/bin/ftponly as their shell. Regards, Lanny Tim Kientzle wrote: > Colin Percival wrote: > >> At 22:36 24/02/2004, David Schultz wrote: >> >>> (1) Fix login(1) so that it disables the -p option when the target >>> user's shell is not in /etc/shells (unless the invoking user >>> is root) >> >> >> Adding /sbin/nologin to /etc/shells is a standard way to create >> ftp-only users. > > > Putting /sbin/nologin as the user's shell in /etc/passwd is > quite standard, yes, for exactly the reason you describe. > > Adding it to /etc/shells is a very different matter, though. > My understanding has always been that /etc/shells is intended to > list the "standard" *interactive* user shells. Special or > restricted shells should not be listed there. > > In particular, /sbin/nologin should certainly not be in /etc/shells. > > chpass(1) has some comments on this. getusershell(3) and > shells(5) are admittedly pretty vague. Perhaps some > manpage-tuning is in order. > >>> (2) Make nologin(8) setgid nobody, so rtld ignores LD_LIBRARY_PATH. >> >> >> Wearing my member-of-security-team hat, I have to say I'm rather >> unhappy with this idea. It's also been pointed out (by nectar) that >> there are issues with NFS if files are owned by nobody or nogroup. > > > Even though I tossed it out as an option, I'm uncomfortable > with it as well just on the "unnecessary setgid" principle. > > My preference at the moment is for nologin(8): > * to be statically linked so it cannot easily be trojaned > * to throw out the current environment and create a clean > environment from scratch before invoking system("logger...") > to perform any logging. > > This would keep the size of nologin(8) down while keeping > it pretty safe. > > Tim Kientzle > > _______________________________________________ > freebsd-current@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Lanny Baron Proud to be 100% FreeBSD http://www.FreeBSDsystems.COM Toll Free: 1.877.963.1900 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=