Date: Wed, 28 Feb 2001 09:09:49 +0100 (CET) From: Paul Herman <pherman@frenchfries.net> To: Steve Reid <sreid@sea-to-sky.net> Cc: Brooks Davis <brooks@one-eyed-alien.net>, Rob Simmons <rsimmons@wlcg.com>, <George.Giles@mcmail.vanderbilt.edu>, <freebsd-security@FreeBSD.ORG> Subject: ssh -t <host> /bin/sh trick (was Re: ftp access) Message-ID: <Pine.BSF.4.32.0102280859500.9459-100000@husten.security.at12.de> In-Reply-To: <20010227202145.A31471@grok.bc.hsia.telus.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 27 Feb 2001, Steve Reid wrote: > On Tue, Feb 27, 2001 at 02:55:12PM -0800, Brooks Davis wrote: > > If you do this be sure to keep users from being able to access the system > > via ssh. Otherwise they can just use ssh to spawn a shell for themselves: > > ssh -t <host> /bin/sh > > Are you certain about this? > > I tried this on a 4.1.1-R box I operate and it didn't let me in. The > box is set up with the ftp login shell set to "/nonexistent/ftponly", > which is listed in /etc/shells but does not exist. This behaviour has changed over the years, which is why there are two conflicting reports. I remember the days (FreeBSD 2.2.6, or so, using ssh from ssh.com) of having to write a small script in /etc/sshrc which checks for invalid shells to prevent what Brooks was describing. Back then, it *did* work. Now (at least with OpenSSH_2_3_0), that trick doesn't work anymore. Don't know when/where/in which version this changed, but my inkling is that PAM is the culprit. -Paul. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.32.0102280859500.9459-100000>