From owner-freebsd-current@FreeBSD.ORG  Tue Feb 24 16:48:15 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 1B30516A4CE; Tue, 24 Feb 2004 16:48:15 -0800 (PST)
Received: from kientzle.com (h-66-166-149-50.SNVACAID.covad.net
	[66.166.149.50])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 26C4E43D1F; Tue, 24 Feb 2004 16:48:14 -0800 (PST)
	(envelope-from tim@kientzle.com)
Received: from kientzle.com (54.kientzle.com [66.166.149.54] (may be forged))
	by kientzle.com (8.12.9/8.12.9) with ESMTP id i1P0ih7g003646;
	Tue, 24 Feb 2004 16:44:43 -0800 (PST)
	(envelope-from tim@kientzle.com)
Message-ID: <403BEFFB.3010702@kientzle.com>
Date: Tue, 24 Feb 2004 16:44:43 -0800
From: Tim Kientzle <tim@kientzle.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.4) Gecko/20031006
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Lanny Baron <lnb@FreeBSDsystems.COM>
References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca>
	<20040224223659.GB69570@VARK.homeunix.com>
	<6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca>
	<403BE4BC.9070009@kientzle.com> <403BE803.40606@FreeBSDsystems.COM>
In-Reply-To: <403BE803.40606@FreeBSDsystems.COM>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: David Schultz <das@freebsd.org>
cc: freebsd-current@freebsd.org
cc: Colin Percival <colin.percival@wadham.ox.ac.uk>
cc: kientzle@acm.org
Subject: Re: What to do about nologin(8)?
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: kientzle@acm.org
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Feb 2004 00:48:15 -0000

Lanny Baron wrote:
> Hi,
> What I have done in the past for preventing logins via telnet/ssh is to 
> make a script called ftponly and put it in /usr/local/bin and in 
> /etc/shells put a line as /usr/local/bin/ftponly
> 
> The little script for /usr/local/bin/ftponly is:
> 
> #!/bin/sh -p
> echo 'This account is currently available only for FTP access.'
> exit 1
> 
> Of course when you run adduser or pw useradd, you will choose 
> /usr/local/bin/ftponly as their shell.

I'm trying to better understand how people are
really using these facilities, so I have a couple
of questions for you:

1) Why did you put it in /etc/shells?

2) Why did you use "-p"?

(I know what -p does; I'd like to know why you
chose it: did you see an example script somewhere
that you copied it from?)

For those who have followed the "dynamic root"
debate, the security implications of a dynamic
/bin/sh are starting to really worry me.
Some form of NSS daemon that can be invoked
from statically-linked executables is starting
to look *really* desirable.

Tim Kientzle