Date: Thu, 25 Oct 2001 01:03:34 -0600 From: "Scott Gerhardt" <scott@gerhardt-it.com> To: "Edwin Groothuis" <edwin@mavetju.org> Cc: "FreeBSD" <freebsd-questions@FreeBSD.ORG> Subject: RE: Which way is better to deny shell access Message-ID: <KPEMLBLEMPMHGLJOCDEGGEBCCLAA.scott@gerhardt-it.com> In-Reply-To: <20011025123858.I552@k7.mavetju.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This may be a better solution: Put the following in your /etc/access.login file -:ALL EXCEPT wheel:ALL This will disable everyone except wheel to login. Add other users or groups you want to allow login access after "wheel" separated by spaces. Putting nonexistent or nologin for shell in /etc/passwd doesn't hurt either. You may need a valid shell for ftp users though. Just add them to /etc/shells Well I'm on the topic of restricting access, It is a good idea to group users i.e. put all the POP3 users in a group (i.e. pop3client). Then for example, you can easily deny ftp access to all POP3 users by adding @pop3client to /etc/ftpusers. It is late at night and my eyes are dreary so if I have made any mistakes here please correct them. I would hate to give out incorrect security information. Regards, _________________________________ Scott Gerhardt, P.Geo. Gerhardt Information Technologies _________________________________ > -----Original Message----- > From: owner-freebsd-questions@FreeBSD.ORG > [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Edwin > Groothuis > Sent: October 24, 2001 8:39 PM > To: BSD Freak > Cc: FreeBSD Questions > Subject: Re: Which way is better to deny shell access > > > On Thu, Oct 25, 2001 at 12:20:16PM +1000, BSD Freak wrote: > > Just wondering.... we have a whole heap of pop3 users... we deny them > > shell access by assigning their shell as /sbin/nologin ( the > same shell > > as many of the system accounts)... however I noticed if I use the > > adduser utility to create a user with no shell, it assigns > /nonexistent > > as their shell...... Which is better? > > /sbin/nologin tells the user that there isn't a valid shell, > after logging in. > /nonexistent will prevent logging in because the shell doesn't exist. > > I think the second is better because it will not tell the user > (intruder, password guesser) that the password was correct. > > Edwin > > -- > Edwin Groothuis | Personal website: http://www.MavEtJu.org edwin@mavetju.org | Interested in MUDs? Visit Fatal Dimensions: ------------------+ http://www.FatalDimensions.org/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?KPEMLBLEMPMHGLJOCDEGGEBCCLAA.scott>