<div dir="ltr"><br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
On Thu, Jan 30, 2014 at 02:35:57PM +0400, Denis Kutin wrote:<br>
> Dear friends,<br>
><br>
> Using sssd, for a long time, I have come across with a problem recently,<br>
> which I would like to solve with your help.<br>
><br>
> I provide centralized authentication and authorization service for a huge<br>
> heterogeneous network. And in my case it would be "nice and easy" if sssd<br>
> used only shells(5). I believe this mechanism is sufficient for<br>
> identification of an allowed shell.<br>
><br>
> I take a liberty to offer you this tiny patch, which will let use wildcard<br>
> (*) in param allowed_shells in sssd.conf<br>
><br>
> What do you think about it?<br>
<br>
Hi,<br>
<br>
the patch itself looks OK except for lines being over 80 characters,<br>
but I don't think I understand the use case well. If a user has a shell<br>
specified that is outside /etc/shells he's kicked out anyway. If he does,<br>
he's permitted by default..<br></blockquote></div><br clear="all"><div>Not exactly. SSSD has a shell_fallback If user has a shell specified that is outside of /etc/shells, SSSD checks allowed_shell parameter. If user's shell is in allowed_shell, then SSSD fallback to shell_fallback, otherwise user kicked out.</div>
<div><br></div><div>Here, from sssd.conf(5)</div><div><div> 1. If the shell is present in “/etc/shells”, it is used.</div><div><br></div><div> 2. If the shell is in the allowed_shells list but not in “/etc/shells”, use the value of the shell_fallback parameter.</div>
<div><br></div><div> 3. If the shell is not in the allowed_shells list and not in “/etc/shells”, a nologin shell is used.</div></div><div><br></div><div>At this moment I need to generate sssd.conf dynamically, specified all existed (in our environment) shells. </div>
<div><br></div>-- </div><div class="gmail_extra">Denis Kutin</div></div>