Summary: | sys-apps/shadow does not provides /usr/sbin/nologin | ||
---|---|---|---|
Product: | Gentoo Linux | Reporter: | Raphael Marichez (Falco) (RETIRED) <falco> |
Component: | New packages | Assignee: | Gentoo's Team for Core System packages <base-system> |
Status: | RESOLVED FIXED | ||
Severity: | trivial | ||
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Package list: | Runtime testing required: | --- |
Description
Raphael Marichez (Falco) (RETIRED)
2008-04-01 13:29:59 UTC
(In reply to comment #0) > Since it would be hard to change all /usr/sbin/nologin entries to > /sbin/nologin sed -i -e 's:/usr/sbin/nologin:/sbin/nologin:g' /etc/passwd does it really matter ? if the login shell doesnt exist, the user cant login. if the login shell does exist, but points to nologin, the user cant login. we could have the shadow ebuild do the upgrade in pkg_postinst ... (In reply to comment #1) > (In reply to comment #0) > > Since it would be hard to change all /usr/sbin/nologin entries to > > /sbin/nologin > > sed -i -e 's:/usr/sbin/nologin:/sbin/nologin:g' /etc/passwd > Obviously a pro-user knows he can run sed or ViM. I'm not speaking for me. It's for basic users. My point is to solve this thought ebuilds only, automatically. Running `sed` in an ebuild on a live /etc/passwd may be dangerous. @Vapier: it's not too important from a security PoV, but nologin is a useful program that : - prints the user a message that his account is not avaible - calls syslog That has two purposes : - inform the user - syslog: differentiate formerly valid then denied account; and generic accounts like named, mysql... You may argue that an administrator of a multi-user SSH box is able to discover and manually fix this issue, but, still, that change of behaviour is surprinsing and may stay hidden for some time... either we run the sed in baselayout to automatically convert /usr/sbin/nologin to /sbin/nologin if $ROOT/usr/sbin/nologin doesnt exist, or we just stick with the standard warning about user accounts with invalid shells. as for nologin displaying an informative message, i'd make the statement that the curt message "This account is currently not available." is just about as useful as no message at all. the syslog aspect though is semi-useful ... i wasnt aware that the binary actually did that. |