I have a few dozen Solaris(5.10) boxes. By default, they are using ksh as the shell. Only a few users have sudo privileges. The rest do not. I don't want my regular users changing to another shell.
Here is what I've done:
Minimal sudoers so /etc/passwd is out of the question for them. Minimal sudoers so usermod -s is out of the question for them.
I have NOT disabled access to the shells in /bin or /usr/bin yet, but it will be done - so please disregard the fact that it hasn't been done yet. So, in theory they could write startup scripts to execute them, right? Am I missing anything else?