[SSSD] Shell overrides

John Hodrien J.H.Hodrien at leeds.ac.uk
Fri Jul 29 12:05:28 UTC 2011


On Fri, 29 Jul 2011, Jakub Hrozek wrote:

> On 07/29/2011 12:56 PM, John Hodrien wrote:
>> Is there a way I can deal with this using the current setup?  I couldn't see a
>> way.
>
> No, not currently. The logic works like this:
>
> 1) if the user's shell is on the machine, use it
> 2) if the user's shell is not installed, but is allowed, map to
> fallback, usually /bin/sh
> 3) else /sbin/nologin
>
> This feature was meant to cover the case where a user with a fancy shell
> would try to log into a machine that does not have his shell available.

Yep.  So am I a strange corner case, or is this something other people would
be interested in?

At the very least to aid people migrating from nss_ldap, it'd be good to have
the nss_ldap equivalent of:

nss_override_attribute_value loginShell /bin/bash

For my uses the additional config option actually brings sssd up a notch on
what I was able to acheive with nss_ldap, but I can understand that our setup
isn't entirely sane.

jh



More information about the sssd-devel mailing list