On Fri, 29 Jul 2011, Jakub Hrozek wrote:
On 07/29/2011 12:56 PM, John Hodrien wrote:
> Is there a way I can deal with this using the current setup? I couldn't see a
> way.
No, not currently. The logic works like this:
1) if the user's shell is on the machine, use it
2) if the user's shell is not installed, but is allowed, map to
fallback, usually /bin/sh
3) else /sbin/nologin
This feature was meant to cover the case where a user with a fancy shell
would try to log into a machine that does not have his shell available.
Yep. So am I a strange corner case, or is this something other people would
be interested in?
At the very least to aid people migrating from nss_ldap, it'd be good to have
the nss_ldap equivalent of:
nss_override_attribute_value loginShell /bin/bash
For my uses the additional config option actually brings sssd up a notch on
what I was able to acheive with nss_ldap, but I can understand that our setup
isn't entirely sane.
jh