Hello,
we have an RFE: Ability of sssd to override shell per group and per user
(described in ticket -
https://fedorahosted.org/sssd/ticket/2135 and BZ
-
https://bugzilla.redhat.com/show_bug.cgi?id=986394)
Is it generally a good idea to override shell per group and user or are
there any hidden security threats?
IIRC we can override shell based on primary group only because in time
when shell overrides are processed no secondary groups are known, is it OK?
Would introducing new configuration options
'override_shell_per_{user,group}' in NSS section be the right way to
implement this RFC?
override_shell_per_user = user1@domain1:sh1, user2:sh2, uid1:sh3
override_shell_per_group = group1@domain1:sh1, group2:sh2, gid1:sh3
Thanks for opinions!