From owner-freebsd-security Wed Feb 28 0:10:16 2001 Delivered-To: freebsd-security@freebsd.org Received: from mr200.netcologne.de (mr200.netcologne.de [194.8.194.109]) by hub.freebsd.org (Postfix) with ESMTP id 151E337B71C for ; Wed, 28 Feb 2001 00:10:12 -0800 (PST) (envelope-from pherman@frenchfries.net) Received: from husten.security.at12.de (dial-213-168-88-186.netcologne.de [213.168.88.186]) by mr200.netcologne.de (Mirapoint) with ESMTP id ABW40742; Wed, 28 Feb 2001 09:10:08 +0100 (CET) Received: from localhost (localhost.security.at12.de [127.0.0.1]) by husten.security.at12.de (8.11.2/8.11.2) with ESMTP id f1S89oi39528; Wed, 28 Feb 2001 09:09:50 +0100 (CET) (envelope-from pherman@frenchfries.net) Date: Wed, 28 Feb 2001 09:09:49 +0100 (CET) From: Paul Herman To: Steve Reid Cc: Brooks Davis , Rob Simmons , , Subject: ssh -t /bin/sh trick (was Re: ftp access) In-Reply-To: <20010227202145.A31471@grok.bc.hsia.telus.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Tue, 27 Feb 2001, Steve Reid wrote: > On Tue, Feb 27, 2001 at 02:55:12PM -0800, Brooks Davis wrote: > > If you do this be sure to keep users from being able to access the system > > via ssh. Otherwise they can just use ssh to spawn a shell for themselves: > > ssh -t /bin/sh > > Are you certain about this? > > I tried this on a 4.1.1-R box I operate and it didn't let me in. The > box is set up with the ftp login shell set to "/nonexistent/ftponly", > which is listed in /etc/shells but does not exist. This behaviour has changed over the years, which is why there are two conflicting reports. I remember the days (FreeBSD 2.2.6, or so, using ssh from ssh.com) of having to write a small script in /etc/sshrc which checks for invalid shells to prevent what Brooks was describing. Back then, it *did* work. Now (at least with OpenSSH_2_3_0), that trick doesn't work anymore. Don't know when/where/in which version this changed, but my inkling is that PAM is the culprit. -Paul. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message