[SSSD] [PATCH] Add options to override GID, homedir and shell

Stephen Gallagher sgallagh at redhat.com
Tue May 10 11:35:42 UTC 2011


On Tue, 2011-05-10 at 10:58 +0200, Jakub Hrozek wrote:
> On 05/09/2011 07:42 PM, Stephen Gallagher wrote:
> > On Mon, 2011-05-09 at 10:45 +0200, Jakub Hrozek wrote:
> >> On 05/06/2011 04:05 PM, Stephen Gallagher wrote:
> >>> get_shell_override() should not shortcut out if there are no allowed
> >>> shells. It should still check /etc/shells because if it's not listed, we
> >>> want to convert it to nologin.
> >>>
> >>
> >> This is done in the attached patch, but I don't agree with the change.
> >>
> >> It differs from the current behaviour and moreover allowed_shells is
> >> unset in the default setting, so the change would affect anyone running
> >> with defaults.
> >>
> > 
> > Well, that wouldn't really have been a change in behavior, since if the
> > shell didn't exist on the system, the login program or SSH would still
> > be denying them. 
> 
> Oh, I though the user would get /bin/sh..
> 
> In this case I agree with you..thank you for explaining.


I was thinking about this more last night, and I think in the end that
you were probably right with how you did this the first time. While it's
true that both 'login' and 'sshd' will just reject the user (actually,
they'll try to exec the shell, get an error from exec and then bail
out), it's possible that other mechanisms like rlogin or telnet or
similar might have their own ways of behaving (implementing their own
fallback, for example).

So I think that we probably need to just punt if we don't have an
allowed_shells option and return the LDAP value.

Sorry for going back and forth on this so many times.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110510/7e133795/attachment.sig>


More information about the sssd-devel mailing list