I am trying to setup per-user fastcgi scripts that will run each on a different port and with a different user. Here is example of my script:



However, if I add user with /bin/false (which I want, since this is about to be something like shared hosting and I don't want users to have shell access), the script is run under 1001, 1002 'user' which, as my Google searches showed, might be a security hole. My question is: Is it possible to allow user(s) to execute shell scripts but disable them so they cannot log in via SSH?


Use the DenyUsers or DenyGroups settings in sshd_config.

| improve this answer | |
  • Did try'd that.. However still having same problem. Side note: I can do 'su user' and execute shell and any other command, but still if I do 'ps aux' I see that command is running under 1002 user.. – Amar Apr 11 '10 at 18:03
  • Which same problem? That they can't execute shell scripts, or that they can log in via SSH? – Ignacio Vazquez-Abrams Apr 11 '10 at 18:07
  • A problem with commands being executed as 1002 and not as actual user.. – Amar Apr 11 '10 at 19:01
  • Even if you were to deny them ssh access, they could still execute shell scripts via the web tree. It's not difficult to make system calls within PHP – sinping Apr 12 '10 at 0:17
  • It is if you use Safe Mode or even something like SELinux. – Ignacio Vazquez-Abrams Apr 12 '10 at 1:11

In the first place, why would you need to have /bin/false as the shell of the user? Why not simply have /bin/bash as the shell, and AllowGroups or DenyGroups setting at sshd_config? This solves the ssh login problem. Without the rights to login via ssh, would the user have shell access?

Alternatively, you can have your user environment script set as the user's shell, and put the user AllowGroups or DenyGroup setting at sshd_config. Of course, your script must be a locked down script. This solves the user environment problem and the ssh login problem.

In other words, which problem are you trying to solve?

| improve this answer | |

You may want to completely block a user from logging in remotely using PAM:



Instead of a single user, you can use a group. Details in man access.conf Then it won't be necessary to set user shell to /bin/false.

| improve this answer | |
  • wouldn't that also block SFTP access? (I want to allow this.. ) – Amar Apr 11 '10 at 18:09
  • Yes, it will. If you want SFTP access and not SSH, you may consider using rssh. Here's an article. This seems like a topic for serverfault.com – Michał Trybus Apr 11 '10 at 18:20

Try using /bin/true instead of /bin/false and see if that affects it.

/bin/false always returns a non-zero value, which can cause problems. /bin/true will work just like /bin/false, except that it returns zero.

| improve this answer | |

It is possible, but if you take away their shell, then no, they can't execute shell scripts. It's not unusual to set a users shell to /sbin/nologin, but it will result in the same thing as setting the shell to false.

The most straight forward answer that was proposed was editing sshd_config and limiting shell access there.

Most other ways of limiting access are less obvious than just configuring the access protocol to deny them.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy