Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup per-user fastcgi scripts that will run each on a different port and with a different user. Here is example of my script:

#!/bin/bash
BIND=127.0.0.1:9001
USER=user
PHP_FCGI_CHILDREN=2
PHP_FCGI_MAX_REQUESTS=10000

etc...

However, if I add user with /bin/false (which I want, since this is about to be something like shared hosting and I don't want users to have shell access), the script is run under 1001, 1002 'user' which, as my Google searches showed, might be a security hole. My question is: Is it possible to allow user(s) to execute shell scripts but disable them so they cannot log in via SSH?

share|improve this question

migrated from stackoverflow.com Apr 11 '10 at 23:06

This question came from our site for professional and enthusiast programmers.

add comment

5 Answers

It is possible, but if you take away their shell, then no, they can't execute shell scripts. It's not unusual to set a users shell to /sbin/nologin, but it will result in the same thing as setting the shell to false.

The most straight forward answer that was proposed was editing sshd_config and limiting shell access there.

Most other ways of limiting access are less obvious than just configuring the access protocol to deny them.

share|improve this answer
add comment

Try using /bin/true instead of /bin/false and see if that affects it.

/bin/false always returns a non-zero value, which can cause problems. /bin/true will work just like /bin/false, except that it returns zero.

share|improve this answer
add comment

In the first place, why would you need to have /bin/false as the shell of the user? Why not simply have /bin/bash as the shell, and AllowGroups or DenyGroups setting at sshd_config? This solves the ssh login problem. Without the rights to login via ssh, would the user have shell access?

Alternatively, you can have your user environment script set as the user's shell, and put the user AllowGroups or DenyGroup setting at sshd_config. Of course, your script must be a locked down script. This solves the user environment problem and the ssh login problem.

In other words, which problem are you trying to solve?

share|improve this answer
add comment

Use the DenyUsers or DenyGroups settings in sshd_config.

share|improve this answer
    
Did try'd that.. However still having same problem. Side note: I can do 'su user' and execute shell and any other command, but still if I do 'ps aux' I see that command is running under 1002 user.. –  Amar Apr 11 '10 at 18:03
    
Which same problem? That they can't execute shell scripts, or that they can log in via SSH? –  Ignacio Vazquez-Abrams Apr 11 '10 at 18:07
    
A problem with commands being executed as 1002 and not as actual user.. –  Amar Apr 11 '10 at 19:01
    
Even if you were to deny them ssh access, they could still execute shell scripts via the web tree. It's not difficult to make system calls within PHP –  sinping Apr 12 '10 at 0:17
    
It is if you use Safe Mode or even something like SELinux. –  Ignacio Vazquez-Abrams Apr 12 '10 at 1:11
add comment

You may want to completely block a user from logging in remotely using PAM:

/etc/security/access.conf:

- : user : ALL EXCEPT LOCAL

Instead of a single user, you can use a group. Details in man access.conf Then it won't be necessary to set user shell to /bin/false.

share|improve this answer
    
wouldn't that also block SFTP access? (I want to allow this.. ) –  Amar Apr 11 '10 at 18:09
    
Yes, it will. If you want SFTP access and not SSH, you may consider using rssh. Here's an article. This seems like a topic for serverfault.com –  Michał Trybus Apr 11 '10 at 18:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.