Subject: Re: User Shell?

From: Peter Gutowski <[email-masked]>
Date: 17 May 2000 10:09:50 -0400

>I would like to make my student file server so that the
>students may not telnet in, but I understand that
>Netatalk requires a full login account.  Will this
>change?  Is there a way around this?  I suppose I could
>remove the telnet service.  Any other ideas?

Of course removing telnet service from inetd.conf ensures that *nobody* (even you!) can telnet in. 

I would recommend using randnum authentication and set an initial password for each user in the ~/.passwd file that is *different* from the unix password (which you will _not_ reveal to them.) Your other message referenced students having email accounts as well, in which case this solution won't work.

-Peter Gutowski

---

From: Andre Pang <[email-masked]>
Date: Thu, 18 May 2000 00:38:26 +1000

On Wed, May 17, 2000 at 10:09:50AM -0400, Peter Gutowski wrote:

> I would recommend using randnum authentication and set an initial password
> for each user in the ~/.passwd file that is *different* from the unix
> password (which you will _not_ reveal to them.) Your other message
> referenced students having email accounts as well, in which case this
> solution won't work.

    a very simple solution, if you're not running NIS(+), would be to change
the shell for all the users to /bin/false, or something similar.  you might
like to use /dev/null, if you're into that sort of thing.  (have a look at
the /etc/passwd file.)

-- 
: Andre Pang <[email-masked]>  -  #ozone  -  ph# 0411.882299 :
:              ...[ = trust in love to save = ]...               :

---

From: "Lancaster, David Matthew" <[email-masked]>
Date: Wed, 17 May 2000 15:34:04 -0300 (ADT)

or set their shells to /dev/false
note that ftp access will fail too. (it checks if the shell is valid, i.e.
in /etc/shells)

David Lancaster                       (506) 454-2167
  690 Gregg Ct.                       Upper Apartment
  Fredericton, NB  Canada             E3B 4H5
  [email-masked]       "Don't anthropomorphize computers, they hate that."

---

From: Prentice <[email-masked]>
Date: Wed, 17 May 2000 16:28:23 -0400

ftp shouldn't fail if you add /dev/false to /etc/shells. 

-- 
Prentice
[email-masked]
Princeton Plasma Physics Lab
http://www.pppl.gov

---

From: Bill Tihen -- TECHNOLOGY <[email-masked]>
Date: Wed, 17 May 2000 22:59:41 +0200

Students don't need ftp or telnet access.  However, I 
thought I remembered that netatalk required a "real" 
shell.  I thought if one used /dev/false then the 
students would no longer be able to access their files 
via netatalk.  Netatalk access is very important.  Has 
this changed?  I thought I just read about someone who 
stumbled into this gotcha.

Bill

Quoting "Lancaster, David Matthew" <[email-masked]>:

> > Of course removing telnet service from inetd.conf 
ensures that *nobody*
> (even you!) can telnet in.
> >
> > I would recommend using randnum authentication and 
set an initial
> password for each user in the ~/.passwd file that is 
*different* from the
> unix password (which you will _not_ reveal to them.) 
Your other message
> referenced students having email accounts as well, in 
which case this

__________________________________________
TASIS (The American School In Switzerland)
Lugano-Montagnola, Switzerland
<http://www.tasis.ch/>

---

From: Cliff Crawford <[email-masked]>
Date: Wed, 17 May 2000 19:27:16 -0400

> stumbled into this gotcha.

I have a very similar setup (actually the user's shells are set to
/bin/passwd, same idea) and have never had a problem with users not
being able to log in via appleshare.  If you're really paranoid, you
could always create yourself a new account, set its shell to
/bin/false, and test it out.

-- 
cliff crawford    -><-    http://www.people.cornell.edu/pages/cjc26/
"One man's nirvana is another man's map."              icq 68165166

---

From: "Lancaster, David Matthew" <[email-masked]>
Date: Wed, 17 May 2000 23:43:46 -0300 (ADT)

IIRC, wu-ftpd (the default ftp server in at least RedHat) checks to see if
a user's shell (read from /etc/passwd) is a valid shell (i.e. in
/etc/shells). So you can prevent telnet and allow ftp by changing to a
"limited" program such as passwd or false and adding the appropriate
entry to /etc/shells. You can prevent both by not adding the entry.

I'm not sure of afpd's requirements, but you could always run a quick test
as suggested earlier. If it *does* require a valid entry in /etc/shells,
put it in, then add an entry to /etc/ftpaccess to prevent the student's
group from being able to login to the ftp server. AFAIK, this should
prevent them from using anything, as they'd need a shell or ftp access to
do "anything".

D.

---

From: "Michael Paesold" <[email-masked]>
Date: Thu, 18 May 2000 09:45:08 +0200

> stumbled into this gotcha.

I have one setup where only few are allowed to telnet or ftp
the server. The shells in /etc/passwd are set to /bin/false,
which is perfectly ok, because it is a valid shell
(see /etc/shells). netatalk works well that way. ftp access
is disabled for most by using the tcpwrapper (see hosts.deny).

Btw, using /bin/true would still allow people to log on to
the X Window System, only if it exists of course...

Greetings,
Mike

-- 
Michael Paesold, mailto:[email-masked]
Vienna, Austria, Europe

---

From: Bill Tihen -- TECHNOLOGY <[email-masked]>
Date: Thu, 18 May 2000 13:31:50 +0200

Thanks for the feedback, I guess it is no necessary to
have a full login shell to use netatalk.

I have now set the accounts to /bin/false -- everything
seems to be working fine.

Bill