1

I am trying to setup per-user fastcgi scripts that will run each on a different port and with a different user. Here is example of my script:

#!/bin/bash
BIND=127.0.0.1:9001
USER=user
PHP_FCGI_CHILDREN=2
PHP_FCGI_MAX_REQUESTS=10000

etc...

However, if I add user with /bin/false (which I want, since this is about to be something like shared hosting and I don't want users to have shell access), the script is run under 1001, 1002 'user' which, as my Google searches showed, might be a security hole. My question is: Is it possible to allow user(s) to execute shell scripts but disable them so they cannot log in via SSH?

5 Answers 5

1

Use the DenyUsers or DenyGroups settings in sshd_config.

5
  • Did try'd that.. However still having same problem. Side note: I can do 'su user' and execute shell and any other command, but still if I do 'ps aux' I see that command is running under 1002 user..
    – Amar
    Apr 11, 2010 at 18:03
  • Which same problem? That they can't execute shell scripts, or that they can log in via SSH? Apr 11, 2010 at 18:07
  • A problem with commands being executed as 1002 and not as actual user..
    – Amar
    Apr 11, 2010 at 19:01
  • Even if you were to deny them ssh access, they could still execute shell scripts via the web tree. It's not difficult to make system calls within PHP
    – sinping
    Apr 12, 2010 at 0:17
  • It is if you use Safe Mode or even something like SELinux. Apr 12, 2010 at 1:11
1

In the first place, why would you need to have /bin/false as the shell of the user? Why not simply have /bin/bash as the shell, and AllowGroups or DenyGroups setting at sshd_config? This solves the ssh login problem. Without the rights to login via ssh, would the user have shell access?

Alternatively, you can have your user environment script set as the user's shell, and put the user AllowGroups or DenyGroup setting at sshd_config. Of course, your script must be a locked down script. This solves the user environment problem and the ssh login problem.

In other words, which problem are you trying to solve?

0

You may want to completely block a user from logging in remotely using PAM:

/etc/security/access.conf:

- : user : ALL EXCEPT LOCAL

Instead of a single user, you can use a group. Details in man access.conf Then it won't be necessary to set user shell to /bin/false.

2
  • wouldn't that also block SFTP access? (I want to allow this.. )
    – Amar
    Apr 11, 2010 at 18:09
  • Yes, it will. If you want SFTP access and not SSH, you may consider using rssh. Here's an article. This seems like a topic for serverfault.com
    – Michał Trybus
    Apr 11, 2010 at 18:20
0

Try using /bin/true instead of /bin/false and see if that affects it.

/bin/false always returns a non-zero value, which can cause problems. /bin/true will work just like /bin/false, except that it returns zero.

0

It is possible, but if you take away their shell, then no, they can't execute shell scripts. It's not unusual to set a users shell to /sbin/nologin, but it will result in the same thing as setting the shell to false.

The most straight forward answer that was proposed was editing sshd_config and limiting shell access there.

Most other ways of limiting access are less obvious than just configuring the access protocol to deny them.

You must log in to answer this question.