Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there an easy way to override the Samba "template shell = /bin/bash" setting on a per-user basis?

This is for Linux systems joined to an Active Directory domain. Some users want /bin/bash. Others including myself want /bin/zsh. Is there some AD attribute I can set?

Anything I've found via googling seems hackish at best (writing a script to replace /bin/sh -- maintenance hassle).

A similar serverfault question Override LDAP shell seems OpenLDAP-oriented (but if someone knows how to get it working with AD, please say so).

share|improve this question

3 Answers 3

If you install Identity Management for Unix (IDMU) on your AD server, the LDAP schema is extended for storing Unix attributes and you can set the login shell in the "Unix Attributes" tab of the (user) object properties.

share|improve this answer

If you're using winbind, you can do the following:

  1. Install IDMU as Christoph suggested. If you have 2003 R2 or later, the necessary RFC 2307 schema is already installed, so you can skip this step.

  2. Add the following to smb.conf, per the Samba wiki:

    winbind nss info = rfc2307
    

    Again, this is only going to work if you're using winbind. Restart it once you've made the change.

  3. Set users' loginShell attribute in Active Directory. winbind will honor that setting on its next refresh.

share|improve this answer
    
I can verify that this works on RHEL 6.5. When loginShell is not set it just uses the template one which is what we wanted. Thanks! –  GeneBean May 30 at 13:41

If you have a large number of Linux systems using AD, this may not be efficient, but for a small number of systems, the simplest way of doing this is to run the following on the Linux machine:

getent passwd ADUSER >> /etc/passwd

Then edit the corresponding line in /etc/passwd to reflect the preferred shell (or better yet, use sed to change the shell entry on the fly before appending to /etc/passwd). IDMU, as others have suggested, is probably the most elegant solution for multiple hosts, but the above example gets the job done if you're just looking to do this on a few systems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.