Date: Tue, 24 Feb 2004 16:44:43 -0800 From: Tim Kientzle <tim@kientzle.com> To: Lanny Baron <lnb@FreeBSDsystems.COM> Cc: kientzle@acm.org Subject: Re: What to do about nologin(8)? Message-ID: <403BEFFB.3010702@kientzle.com> In-Reply-To: <403BE803.40606@FreeBSDsystems.COM> References: <6.0.1.1.1.20040223171828.03de8b30@imap.sfu.ca> <20040224223659.GB69570@VARK.homeunix.com> <6.0.1.1.1.20040224225502.03dcfb10@imap.sfu.ca> <403BE4BC.9070009@kientzle.com> <403BE803.40606@FreeBSDsystems.COM>
next in thread | previous in thread | raw e-mail | index | archive | help
Lanny Baron wrote: > Hi, > What I have done in the past for preventing logins via telnet/ssh is to > make a script called ftponly and put it in /usr/local/bin and in > /etc/shells put a line as /usr/local/bin/ftponly > > The little script for /usr/local/bin/ftponly is: > > #!/bin/sh -p > echo 'This account is currently available only for FTP access.' > exit 1 > > Of course when you run adduser or pw useradd, you will choose > /usr/local/bin/ftponly as their shell. I'm trying to better understand how people are really using these facilities, so I have a couple of questions for you: 1) Why did you put it in /etc/shells? 2) Why did you use "-p"? (I know what -p does; I'd like to know why you chose it: did you see an example script somewhere that you copied it from?) For those who have followed the "dynamic root" debate, the security implications of a dynamic /bin/sh are starting to really worry me. Some form of NSS daemon that can be invoked from statically-linked executables is starting to look *really* desirable. Tim Kientzle
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?403BEFFB.3010702>