Date: Fri, 22 Mar 2002 15:36:57 -0500 From: Anthony Schneider <aschneid@mail.slc.edu> To: Fernan Aguero <fernan@iib.unsam.edu.ar> Cc: FreeBSD Security <freebsd-security@FreeBSD.ORG> Subject: Re: su -c user command not working Message-ID: <20020322153657.A3593@mail.slc.edu> In-Reply-To: <20020322165816.A561@iib.unsam.edu.ar>; from fernan@iib.unsam.edu.ar on Fri, Mar 22, 2002 at 04:58:17PM -0300 References: <20020322165816.A561@iib.unsam.edu.ar>
next in thread | previous in thread | raw e-mail | index | archive | help
--oyUTqETQ0mS9luUI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
the -c flag passes a command to the shell of the user you are su'ing to,
so since user man's shell is /sbin/nologin, /sbin/nologin is (according
to su) supposed to interpret the command 'catman' and execute it,
however /sbin/nologin doesn't interpret commands, it just prints the
message "This account is currently unavailable" (just as it did for you)
and then exits. for 'su -c' to work, the user you are su'ing to needs
something to actually interpret the command. i suggest you either change
that user's passwd info to have such a shell, or you to an account that
has such a shell.
as for xterm reading your .cshrc, you need to pass it the option -ls,=20
which tells it to launch a login shell.
-Anthony.
On Fri, Mar 22, 2002 at 04:58:17PM -0300, Fernan Aguero wrote:
> I wonder if this is security related.=20
>=20
> Basically I'd like to know if this has been disabled for security
> reasons.
>=20
> According to su(1) you can do something like:=20
> su man -c catman
> Runs the command catman as user man. You will be asked for man's
> password unless your real UID is 0.
> =09
> However, I am refused to run the example in this way (I am root, of=20
> course).=20
>=20
> root> su man -c catman
> This account is currently not available.
>=20
> man is listed in /etc/passwd with /sbin/nologin as shell
>=20
> I'd also like to know why my ~/.cshrc is not read when I log in or
> open an xterm. I have to source it every time. Is this also related to
> the previous issue (disabled for some reason?)
>=20
> I am running FreeBSD-4.3 (RELENG_4_3), and except for some minor
> things haven't done major configuration or editing of system base
> defaults.
>=20
> Thanks in advance for any help or pointers,
>=20
> Fernan
>=20
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
-----------------------------------------------
PGP key at:
http://www.keyserver.net/
http://www.anthonydotcom.com/gpgkey/key.txt
Home:
http://www.anthonydotcom.com
-----------------------------------------------
--oyUTqETQ0mS9luUI
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAjyblekACgkQ+rDjkNht5F0jPQCfXnC3F/2P5GhhJl4Gsqyro8ko
qCUAnR+fL4F2CJorzOPZihR5d16ewe3d
=7DOs
-----END PGP SIGNATURE-----
--oyUTqETQ0mS9luUI--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020322153657.A3593>