Solved

Can the /etc/passwd file have a script instead of shell for login-shell on RedHat Enterprise Linux 6.4

Posted on 2014-07-25
9
1,637 Views
Last Modified: 2014-08-04
On an older RedHat EL 4.6 server, /etc/passwd has a script instead of a shell in the login-shell field. This was for security reasons, so the user could not get into bash.
For example: user:x:520:501:comment:/home/:/usr/local/bin/online_users.sh

Is it possible to do on a Red Hat EL 6.4 server? I tried it,  but the user gets access denied when she tries to log in. Do I need to set something else up? The user will always be using /bin/bash shell.
0
Comment
Question by:penguins_rule
  • 4
  • 2
  • 2
  • +1
9 Comments
 
LVL 23

Expert Comment

by:savone
ID: 40220232
If they do not have a shell they will not be able to log in.

How is the user logging in? Via SSH, GUI, SFTP??
0
 
LVL 1

Author Comment

by:penguins_rule
ID: 40220347
If the online_users.sh exists in their /home directory, then it works.
I am having a problem with access control (acl) and permissions. So, I will see what happens once I get that straightened out.

To answer savone: The users log in using putty on a windows PC.
0
 
LVL 23

Assisted Solution

by:savone
savone earned 167 total points
ID: 40220744
I don't know what is in online_users.sh, but they will need a valid shell to login via SSH.
0
 
LVL 61

Assisted Solution

by:gheist
gheist earned 167 total points
ID: 40223174
You need binary program as shell
/bin/true /bin/false and /sbin/nologin are good noop-shells.
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 1

Author Comment

by:penguins_rule
ID: 40224831
Is it possible to change something in PAM auth to allow any shell?
0
 
LVL 37

Assisted Solution

by:Harisha M G
Harisha M G earned 166 total points
ID: 40224846
Check a these things to begin:

1. Whether the script has execute permission for the user?
2. Whether the script is accessible for the user?
3. Whether the user gets the same error when he tries to run the script after logging in?
0
 
LVL 61

Expert Comment

by:gheist
ID: 40224855
You can enter any program in /etc/shells
0
 
LVL 1

Accepted Solution

by:
penguins_rule earned 0 total points
ID: 40228983
Listing the script in /etc/shells did not work because it could not run /bin/bash
The user had no problem running the script after logging in when the /etc/passwd login program was /bin/bash
As far as I could tell, the directories and script had the group set correctly and the script was executable

I was able to create a little script initial_script.sh in the user's home directory and then set the login shell in /etc/passwd to it

>cat /home/user/initial_script.sh
#!/bin/bash
source /usr/local/bin/online_users.sh
exit
0
 
LVL 1

Author Closing Comment

by:penguins_rule
ID: 40238543
With information from the experts, I was able to come up with a way to do what i needed to do. Because I did not want to give them access to the shell, this was the method used.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now