12

I'm new to CentOS (running CentOS 6). I have previous experience with OpenSuse.

I'm trying to setup an account for a user. I don't want the account to be available for login via ssh or via the login screen. But, I still want to be able to log into the user by using su command. This allows me to run certain applications as the user with restricted access. The user is not a super user, so it cannot effect applications of other users.

Any help would be greatly appreciated. I generally want to use this to run Glassfish server etc.

1
  • So how did you solve that with OpenSuSE?
    – Nils
    Dec 3, 2011 at 21:03

3 Answers 3

18

On centos, you would setup with a user with no shell by using /sbin/nologin:

[root@localhost ~]# grep named /etc/passwd
named:x:25:25:Named:/var/named:/sbin/nologin
[root@localhost ~]# 

If you need to become that, use -s parameter and put as the argument the shell of your choice, like so:

[root@localhost ~]# su - named -s /bin/bash
-bash-4.1$ 

Note that if you use bash, it will read the settings from /etc/profile first and will default to those settings if there is no existing .bash_profile, .bash_login or.profile in the user home directory. Of course, if you want to use your existing environment settings that exists in root, you can just remove the dash:

exit [

root@localhost ~]# su - named -s /bin/bash
-bash-4.1$ echo $PATH
/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin
-bash-4.1$ exit
logout
[root@localhost ~]# su named -s /bin/bash
bash-4.1$ echo $PATH
/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
bash-4.1$ 
0
0

One common way is to set the user's shell to /bin/false

5
  • I've tried setting it to /bin/false but it seems like centOS 6 does not have this option. It does have a bin/nologin option, but this does not allow me to su into the user account.
    – likenoother
    Dec 3, 2011 at 13:12
  • try su -m username
    – unbeli
    Dec 3, 2011 at 13:17
  • If I set the user to /sbin/nologin and I try to su with the -m option it tells me that the account is not currently available. I've also tried adding the /bin/false to the shells file. When I do this the su command simply does not switch to the user.
    – likenoother
    Dec 3, 2011 at 13:20
  • ok, do NOT add /bin/false to the shells file. Set user's shell to /bin/false. Use su -m.
    – unbeli
    Dec 3, 2011 at 13:22
  • I've removed it from the /etc/shells file and set the user's shell to /bin/false using the usermod command. If I now try to su -m username it tells me that I do not have permissions to .bashrc . I am logged in as root. If I now do: su - username it gives me no error, but I'm still seen as root. Is this normal in Centos?
    – likenoother
    Dec 3, 2011 at 13:26
0

I do normally put an "x" into the encrypted password field of such "technical" users. So the user will not have any possible password. If there is also now public key in the authorized_keys of that user, that account should be pretty safe.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .