From owner-freebsd-current@FreeBSD.ORG Tue Feb 24 15:56:46 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 94C7116A4CE; Tue, 24 Feb 2004 15:56:46 -0800 (PST) Received: from kientzle.com (h-66-166-149-50.SNVACAID.covad.net [66.166.149.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0E54443D31; Tue, 24 Feb 2004 15:56:46 -0800 (PST) (envelope-from tim@kientzle.com) Received: from kientzle.com (54.kientzle.com [66.166.149.54] (may be forged)) by kientzle.com (8.12.9/8.12.9) with ESMTP id i1ONuj7g003199; Tue, 24 Feb 2004 15:56:45 -0800 (PST) (envelope-from tim@kientzle.com) Message-ID: <403BE4BC.9070009@kientzle.com> Date: Tue, 24 Feb 2004 15:56:44 -0800 From: Tim Kientzle User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.4) Gecko/20031006 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Colin Percival References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca> <20040224223659.GB69570@VARK.homeunix.com> <6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca> In-Reply-To: <6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: David Schultz cc: freebsd-current@freebsd.org Subject: Re: What to do about nologin(8)? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: kientzle@acm.org List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Feb 2004 23:56:46 -0000 Colin Percival wrote: > At 22:36 24/02/2004, David Schultz wrote: > >> (1) Fix login(1) so that it disables the -p option when the target >> user's shell is not in /etc/shells (unless the invoking user >> is root) > > Adding /sbin/nologin to /etc/shells is a standard way to create > ftp-only users. Putting /sbin/nologin as the user's shell in /etc/passwd is quite standard, yes, for exactly the reason you describe. Adding it to /etc/shells is a very different matter, though. My understanding has always been that /etc/shells is intended to list the "standard" *interactive* user shells. Special or restricted shells should not be listed there. In particular, /sbin/nologin should certainly not be in /etc/shells. chpass(1) has some comments on this. getusershell(3) and shells(5) are admittedly pretty vague. Perhaps some manpage-tuning is in order. >> (2) Make nologin(8) setgid nobody, so rtld ignores LD_LIBRARY_PATH. > > Wearing my member-of-security-team hat, I have to say I'm rather > unhappy with this idea. It's also been pointed out (by nectar) that > there are issues with NFS if files are owned by nobody or nogroup. Even though I tossed it out as an option, I'm uncomfortable with it as well just on the "unnecessary setgid" principle. My preference at the moment is for nologin(8): * to be statically linked so it cannot easily be trojaned * to throw out the current environment and create a clean environment from scratch before invoking system("logger...") to perform any logging. This would keep the size of nologin(8) down while keeping it pretty safe. Tim Kientzle