Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new to CentOS (running CentOS 6). I have previous experience with OpenSuse.

I'm trying to setup an account for a user. I don't want the account to be available for login via ssh or via the login screen. But, I still want to be able to log into the user by using su command. This allows me to run certain applications as the user with restricted access. The user is not a super user, so it cannot effect applications of other users.

Any help would be greatly appreciated. I generally want to use this to run Glassfish server etc.

share|improve this question

migrated from stackoverflow.com Dec 3 '11 at 16:40

This question came from our site for professional and enthusiast programmers.

    
So how did you solve that with OpenSuSE? –  Nils Dec 3 '11 at 21:03
add comment

3 Answers 3

up vote 6 down vote accepted

On centos, you would setup with a user with no shell by using /bin/nologin:

[root@localhost ~]# grep named /etc/passwd
named:x:25:25:Named:/var/named:/sbin/nologin
[root@localhost ~]# 

If you need to become that, use -s parameter and put as the argument the shell of your choice, like so:

[root@localhost ~]# su - named -s /bin/bash
-bash-4.1$ 

Note that if you use bash, it will read the settings from /etc/profile first and will default to those settings if there is no existing .bash_profile, .bash_login or.profile in the user home directory. Of course, if you want to use your existing environment settings that exists in root, you can just remove the dash:

exit [

root@localhost ~]# su - named -s /bin/bash
-bash-4.1$ echo $PATH
/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin
-bash-4.1$ exit
logout
[root@localhost ~]# su named -s /bin/bash
bash-4.1$ echo $PATH
/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
bash-4.1$ 
share|improve this answer
    
That solved it. Thank you for the great example. –  likenoother Dec 6 '11 at 10:11
add comment

One common way is to set the user's shell to /bin/false

share|improve this answer
    
I've tried setting it to /bin/false but it seems like centOS 6 does not have this option. It does have a bin/nologin option, but this does not allow me to su into the user account. –  likenoother Dec 3 '11 at 13:12
    
try su -m username –  unbeli Dec 3 '11 at 13:17
    
If I set the user to /sbin/nologin and I try to su with the -m option it tells me that the account is not currently available. I've also tried adding the /bin/false to the shells file. When I do this the su command simply does not switch to the user. –  likenoother Dec 3 '11 at 13:20
    
ok, do NOT add /bin/false to the shells file. Set user's shell to /bin/false. Use su -m. –  unbeli Dec 3 '11 at 13:22
    
I've removed it from the /etc/shells file and set the user's shell to /bin/false using the usermod command. If I now try to su -m username it tells me that I do not have permissions to .bashrc . I am logged in as root. If I now do: su - username it gives me no error, but I'm still seen as root. Is this normal in Centos? –  likenoother Dec 3 '11 at 13:26
add comment

I do normally put an "x" into the encrypted password field of such "technical" users. So the user will not have any possible password. If there is also now public key in the authorized_keys of that user, that account should be pretty safe.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.