LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 02-25-2009, 11:16 PM   #1
tljacobs
LQ Newbie
 
Registered: Oct 2008
Posts: 3

Rep: Reputation: 0
Need help modifying users profile to use bash -r at login


Can someone tell me how to set up the bash profile so that when a user logs in, bash -r is executed giving them restricted shell?

Thanks in advance,

Terry
 
Old 02-26-2009, 02:24 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,173
Blog Entries: 54

Rep: Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809
Quote:
Originally Posted by tljacobs View Post
Can someone tell me how to set up the bash profile so that when a user logs in, bash -r is executed giving them restricted shell?
Not in the profile but by linking /path/to/bash to /path/to/rbash and using /path/to/rbash in their passwd entry. You may have arrived at the conclusion Rbash serves your purposes based on you 0) not knowing anything else, 1) not wanting to fiddle with depencencies like required for a proper chroot jail or 2) some other reason, but please note of all the access restriction measures you can implement Rbash actually is one of the weakest ones. If you post exactly what you require Rbash for maybe we could help you more or better...
 
Old 02-26-2009, 09:29 AM   #3
tljacobs
LQ Newbie
 
Registered: Oct 2008
Posts: 3

Original Poster
Rep: Reputation: 0
locking down sftp users to their home directory

Quote:
Originally Posted by unSpawn View Post
Not in the profile but by linking /path/to/bash to /path/to/rbash and using /path/to/rbash in their passwd entry. You may have arrived at the conclusion Rbash serves your purposes based on you 0) not knowing anything else, 1) not wanting to fiddle with depencencies like required for a proper chroot jail or 2) some other reason, but please note of all the access restriction measures you can implement Rbash actually is one of the weakest ones. If you post exactly what you require Rbash for maybe we could help you more or better...
Yes, I guess it would help to be more specific. I need to improve secutiry on my FTP server. Specifically logins via sftp from leaving their home directory. I've managed to lock down ftp logins by modifying the vsftpd.conf file. It appears that my best recourse is building a chroot jail, something I'm not familiar with.

From the testing I've recently done, modifying the shell doesn't affect SFTP logins, so the rbash scenario is out the window. The OS on this server is CentOS 5.3 if that helps.

Any help/advice is appreciated.

Terry
 
Old 02-26-2009, 12:36 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,173
Blog Entries: 54

Rep: Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809Reputation: 2809
Quote:
Originally Posted by tljacobs View Post
It appears that my best recourse is building a chroot jail, something I'm not familiar with.
You're in luck. Not only for having chosen a robust FTP daemon with a good security record, but one with extensive documentation (no hidden sarcasm there). So all you have to want to do is read /usr/share/doc/vsftpd-.*/EXAMPLE/.*.


Quote:
Originally Posted by tljacobs View Post
From the testing I've recently done, modifying the shell doesn't affect SFTP logins, so the rbash scenario is out the window. The OS on this server is CentOS 5.3 if that helps.
Yeah, SFTP != FTPS. Since version 4.9 OpenSSH has chroot functionality (as in chrootssh.sourceforge.net) built in, else there's Rssh and SCPOnly. If yous earch this forum you're bout to find threads, else check out http://www.linuxquestions.org/questi...oblems-597142/.

Last edited by unSpawn; 02-26-2009 at 12:39 PM. Reason: %docdir
 
Old 03-01-2009, 02:09 PM   #5
tljacobs
LQ Newbie
 
Registered: Oct 2008
Posts: 3

Original Poster
Rep: Reputation: 0
Smile

Quote:
Originally Posted by unSpawn View Post
You're in luck. Not only for having chosen a robust FTP daemon with a good security record, but one with extensive documentation (no hidden sarcasm there). So all you have to want to do is read /usr/share/doc/vsftpd-.*/EXAMPLE/.*.



Yeah, SFTP != FTPS. Since version 4.9 OpenSSH has chroot functionality (as in chrootssh.sourceforge.net) built in, else there's Rssh and SCPOnly. If yous earch this forum you're bout to find threads, else check out http://www.linuxquestions.org/questi...oblems-597142/.
thanks very much for you input and advice. I'll check out the documentation.

Regards,
Terry
 
  


Reply

Tags
restricted, shell


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
RHEL5 X-windows login- /etc/profile not being used by KSH users only caseybea Red Hat 0 06-03-2008 10:13 AM
Can't login after modifying /etc/passwd loadedmind Solaris / OpenSolaris 4 01-18-2006 11:11 PM
Modifying users' privlleges in mysql; dropping Swakoo Linux - General 0 11-13-2005 09:36 PM
bash: modifying a variable in a block eantoranz Programming 4 06-28-2005 11:52 AM
Sarge, KDE 3.2.3: modifying /etc/profile doesn't change path dezert_fox Debian 5 01-11-2005 10:22 PM


All times are GMT -5. The time now is 02:24 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration