[SUMMARY] Honoring /etc/shells

Bowers Martin-r1aajq <Martin.Bowers-3WKxDLwmzFNWk0Htik3J/[email protected]>
Newsgroups gmane.linux.admin.managers
Message-ID <[email protected]>
Thanks to all those who replied (especially Neal!).  It turns out there are two solutions, both using PAM and SSH:

1) Adding the following line to /etc/pam.d/sshd:

auth       required     /lib/security/pam_shells.so

This solves my original request by checking the /etc/shells file before allowing a user to login.  I'm not sure why this isn't enabled by default, but it will be on all my machines from now on..

2) Adding the following line to /etc/pam.d/sshd:

auth       required     /lib/security/pam_listfile.so item=user sense=allow file=/etc/loginusers onerr=succeed

This will consult a file (in this case /etc/loginusers) to see whether the username trying to login matches a username in the file.  The advantage to this method is that it will log failures by default, which I like :-)

Again, those to all who sent replies, I appreciate it!

-Marty

-----Original Message-----
From: Bowers Martin-r1aajq [mailto:Martin.Bowers-3WKxDLwmzFNWk0Htik3J/[email protected]]
Sent: Tuesday, August 19, 2003 11:15 AM
To: linuxmanagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
Subject: Honoring /etc/shells


Hello, is there a way to force login to honor /etc/shells in Linux the way Solaris does?  I want to use this as a restriction mechanism so that a user that doesn't have his/her shell listed won't be able to login to the machine, but for some reason the login mechanism in Linux just seems to ignore /etc/shells all together.

Oh, and just some background info, I am using LDAP for authentication, so running in compat mode isn't an option for login restriction.  However, if anyone has other ideas for restricting login access to a Linux machine to a select number of users, please let me know!

TIA!

-Marty
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.