[SUMMARY] Honoring /etc/shells
Bowers Martin-r1aajq <Martin.Bowers-3WKxDLwmzFNWk0Htik3J/[email protected]>
| Newsgroups | gmane.linux.admin.managers |
|---|---|
| Message-ID | <[email protected]> |
Thanks to all those who replied (especially Neal!). It turns out there are two solutions, both using PAM and SSH: 1) Adding the following line to /etc/pam.d/sshd: auth required /lib/security/pam_shells.so This solves my original request by checking the /etc/shells file before allowing a user to login. I'm not sure why this isn't enabled by default, but it will be on all my machines from now on.. 2) Adding the following line to /etc/pam.d/sshd: auth required /lib/security/pam_listfile.so item=user sense=allow file=/etc/loginusers onerr=succeed This will consult a file (in this case /etc/loginusers) to see whether the username trying to login matches a username in the file. The advantage to this method is that it will log failures by default, which I like :-) Again, those to all who sent replies, I appreciate it! -Marty -----Original Message----- From: Bowers Martin-r1aajq [mailto:Martin.Bowers-3WKxDLwmzFNWk0Htik3J/[email protected]] Sent: Tuesday, August 19, 2003 11:15 AM To: linuxmanagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected] Subject: Honoring /etc/shells Hello, is there a way to force login to honor /etc/shells in Linux the way Solaris does? I want to use this as a restriction mechanism so that a user that doesn't have his/her shell listed won't be able to login to the machine, but for some reason the login mechanism in Linux just seems to ignore /etc/shells all together. Oh, and just some background info, I am using LDAP for authentication, so running in compat mode isn't an option for login restriction. However, if anyone has other ideas for restricting login access to a Linux machine to a select number of users, please let me know! TIA! -Marty submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected] subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers _______________________________________________ LinuxManagers mailing list - http://www.linuxmanagers.org submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected] subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers