Date: Wed, 28 Feb 2001 10:46:40 -0700 (MST) From: Nate Williams <nate@yogotech.com> To: Paul Herman <pherman@frenchfries.net> Cc: Steve Reid <sreid@sea-to-sky.net>, Brooks Davis <brooks@one-eyed-alien.net>, Rob Simmons <rsimmons@wlcg.com>, <George.Giles@mcmail.vanderbilt.edu>, <freebsd-security@FreeBSD.ORG> Subject: Re: ssh -t <host> /bin/sh trick (was Re: ftp access) Message-ID: <15005.14720.989013.390180@nomad.yogotech.com> In-Reply-To: <Pine.BSF.4.32.0102280859500.9459-100000@husten.security.at12.de> References: <20010227202145.A31471@grok.bc.hsia.telus.net> <Pine.BSF.4.32.0102280859500.9459-100000@husten.security.at12.de>
next in thread | previous in thread | raw e-mail | index | archive | help
> > > If you do this be sure to keep users from being able to access the system > > > via ssh. Otherwise they can just use ssh to spawn a shell for themselves: > > > ssh -t <host> /bin/sh > > > > Are you certain about this? > > > > I tried this on a 4.1.1-R box I operate and it didn't let me in. The > > box is set up with the ftp login shell set to "/nonexistent/ftponly", > > which is listed in /etc/shells but does not exist. > > This behaviour has changed over the years, which is why there are two > conflicting reports. > > I remember the days (FreeBSD 2.2.6, or so, using ssh from ssh.com) of > having to write a small script in /etc/sshrc which checks for invalid > shells to prevent what Brooks was describing. Back then, it *did* > work. Strange. I'm using an older setup (2.2.8 client, 3.4 server), both using SSH.com software, and it doesn't work. You have me worried for a moment.. :) > Now (at least with OpenSSH_2_3_0), that trick doesn't work anymore. > Don't know when/where/in which version this changed, but my inkling is > that PAM is the culprit. I'm not use OpenSSH and/or PAM with SSH on my box, and it doesn't work. Nate To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?15005.14720.989013.390180>