[SSSD] Shell overrides

John Hodrien J.H.Hodrien at leeds.ac.uk
Fri Jul 29 10:56:12 UTC 2011


I've just been playing with the allowed_shells stuff.  I'm using a very large
LDAP tree.  It contains mostly good data, but has some users shells set to
/bin/sh and /bin/csh.  For these users I want to override the shell to
something more sane (like /bin/bash).  But I don't want to actually remove
those shells from systems, as I want them to be available for local accounts
and scripts.

So on the client I have local accounts that make use of /bin/sh and /bin/csh
and an /etc/shells of:

/bin/sh
/bin/bash
/sbin/nologin
/bin/tcsh
/bin/csh

If I don't edit /etc/shells it'll use those shells, which isn't what I want.
If I remove it from /etc/shells, and set allowed_shells to an approved list,
it'll switch their shell to nologin.

Is there a way I can deal with this using the current setup?  I couldn't see a
way.

I was wondering about adding a new config option to allow you to mark certain
shells as being vetoed, such that the fallback shell is used instead.  Is this
in any way sane?

Ignoring the trimmings, the meat of it is just:

diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c sssd-1.5.11/src/responder/nss/nsssrv_cmd.c
--- sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c     2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/responder/nss/nsssrv_cmd.c  2011-07-28 15:46:10.787877792 +0100
@@ -314,7 +314,18 @@

      user_shell = ldb_msg_find_attr_as_string(msg, SYSDB_SHELL, NULL);
      if (!user_shell) return NULL;
-    if (!nctx->allowed_shells) return talloc_strdup(mem_ctx, user_shell);
+    if (!nctx->allowed_shells && !nctx->vetoed_shells) return talloc_strdup(mem_ctx, user_shell);
+
+    if (nctx->vetoed_shells)
+    {
+        for (i=0; nctx->vetoed_shells[i]; i++) {
+            if (strcmp(nctx->vetoed_shells[i], user_shell) == 0) {
+                DEBUG(5, ("The shell '%s' is vetoed. "
+                         "Using fallback\n", user_shell));
+                return talloc_strdup(mem_ctx, nctx->shell_fallback);
+            }
+        }
+    }

By all means tell me I'm mad and there are much better ways of achieving what
I'm trying to do.  I'm new to sssd, but it looks like it offers a whole raft
of advantages over nss_ldap (which I'm currently using) that makes it look
irresistable.

Thanks,

jh



More information about the sssd-devel mailing list