On 22:52 20 Dec 2002, Christian Hammers <[EMAIL PROTECTED]> wrote: | On Thu, Dec 19, 2002 at 02:34:15PM -0800, Brian Hatch wrote: | > To have no shell, you'd want | > news:x:9:13:news:/etc/news:/nosuchprogram | > or something similar. Many folks use '/bin/false' for | > example. | | I'm wondering why I would want that - until now nobody could give me a | good argument although everybody learns to remove the shells :-( | | * If I give my users a disabled password, they cannot? login via passwd | based ssh/ftp/pop3 etc. | | * But, on the other hand, I can have a | su news -c /usr/local/script_running_as_user_news.sh
Every user with a shell is a user under which "stuff" can be done. For example, is a cracker exploits, say, your innd (if you're running a local news server, as "news"), then they could do stuff like make a crontab (needs a login shell), etc. Many facilities (eg ftp) outright refuse access to users without shells in the /etc/shells file, thus closing the door somewhat. Basicly it reduces the usefulness of those ids to nasty purposes in a variety of ways. -- Cameron Simpson, DoD#743 [EMAIL PROTECTED] http://www.zip.com.au/~cs/ The most frightening thing about the American judicial system is the possibility of having one's fate decided by twelve people too stupid to evade jury duty...
