Hi, an old behaviour seems to set /usr/sbin/nologin as shell, not /sbin/nologin. Since it would be hard to change all /usr/sbin/nologin entries to /sbin/nologin, i propose ln -s /sbin/nologin /usr/sbin/ e.g. : [sleipnir:~]% grep nologin /etc/passwd sockd:x:101:2:added by portage for dante:/etc/socks:/usr/sbin/nologin ntp:x:123:123:added by portage for ntp:/dev/null:/usr/sbin/nologin apache:x:81:81:added by portage for apache:/var/www:/usr/sbin/nologin privoxy:x:102:1001:added by portage for privoxy:/etc/privoxy:/usr/sbin/nologin postgrey:x:103:1002:added by portage for postgrey:/dev/null:/usr/sbin/nologin ntop:x:104:1003:added by portage for ntop:/var/lib/ntop:/usr/sbin/nologin smokeping:x:105:1004:added by portage for smokeping:/var/lib/smokeping:/usr/sbin/nologin mysql:x:60:60:added by portage for mysql:/dev/null:/usr/sbin/nologin arpwatch:x:106:1006:added by portage for arpwatch:/var/lib/arpwatch:/usr/sbin/nologin clamav:x:107:1007:added by portage for clamav:/dev/null:/usr/sbin/nologin dhcp:x:108:1008:added by portage for dhcp:/var/lib/dhcp:/usr/sbin/nologin shttpd:x:109:1009:added by portage for shttpd:/var/www/localhost/htdocs:/usr/sbin/nologin proftpd:x:110:1010:added by portage for proftpd:/dev/null:/usr/sbin/nologin messagebus:x:111:1011:added by portage for dbus:/dev/null:/sbin/nologin ftp:x:21:21:added by portage for ftpbase:/home/ftp:/sbin/nologin rpc:x:113:111:added by portage for portmap:/dev/null:/sbin/nologin bacula:x:114:1013:added by portage for bacula:/var/lib/bacula:/sbin/nologin named:x:40:40:added by portage for bind:/etc/bind:/sbin/nologin zope:x:261:261:added by portage for zope:/var/lib/zope:/sbin/nologin polw:x:115:1017:added by portage for policyd-weight:/dev/null:/sbin/nologin tcpdump:x:116:1018:added by portage for tcpdump:/dev/null:/sbin/nologin at:x:25:25:added by portage for at:/var/spool/cron/atjobs:/sbin/nologin asterisk:x:112:1021:added by portage for asterisk:/var/lib/asterisk:/sbin/nologin xfs:x:33:33:added by portage for xfs:/etc/X11/fs:/sbin/nologin
(In reply to comment #0) > Since it would be hard to change all /usr/sbin/nologin entries to > /sbin/nologin sed -i -e 's:/usr/sbin/nologin:/sbin/nologin:g' /etc/passwd
does it really matter ? if the login shell doesnt exist, the user cant login. if the login shell does exist, but points to nologin, the user cant login. we could have the shadow ebuild do the upgrade in pkg_postinst ...
(In reply to comment #1) > (In reply to comment #0) > > Since it would be hard to change all /usr/sbin/nologin entries to > > /sbin/nologin > > sed -i -e 's:/usr/sbin/nologin:/sbin/nologin:g' /etc/passwd > Obviously a pro-user knows he can run sed or ViM. I'm not speaking for me. It's for basic users. My point is to solve this thought ebuilds only, automatically. Running `sed` in an ebuild on a live /etc/passwd may be dangerous. @Vapier: it's not too important from a security PoV, but nologin is a useful program that : - prints the user a message that his account is not avaible - calls syslog That has two purposes : - inform the user - syslog: differentiate formerly valid then denied account; and generic accounts like named, mysql... You may argue that an administrator of a multi-user SSH box is able to discover and manually fix this issue, but, still, that change of behaviour is surprinsing and may stay hidden for some time...
either we run the sed in baselayout to automatically convert /usr/sbin/nologin to /sbin/nologin if $ROOT/usr/sbin/nologin doesnt exist, or we just stick with the standard warning about user accounts with invalid shells. as for nologin displaying an informative message, i'd make the statement that the curt message "This account is currently not available." is just about as useful as no message at all. the syslog aspect though is semi-useful ... i wasnt aware that the binary actually did that.
http://sources.gentoo.org/sys-apps/baselayout/baselayout-2.0.0.ebuild?r1=1.3&r2=1.4
