Hi all,
I'm looking into and just wondering about just what it means when adding a user for use to run daemons/scripts or whatever. Basically whats the most secure way to create a user and allow this to happen. The way i do it is basically:-
groupadd testone
useradd -G testone testone


And then i'm thinking can you make that user more secure with making the shell default /bin/false and by adding the user in this way without use of a password is it possible to login as this user or does something else have to take place first maybe a `passwd`. In the state above of just adding the user and doing nothing else to it, how secure is that, could someone be able to login as that user even though there is no password for it....etc etc


is just something i'm suddenly interested in.

Regards

Consider installing Webmin. You can control all of these options when creating new users.

Thanks...i know all about webmin...i'm know how to set the various parameters... the thing i'm looking for is would it make a user thats been created just for the use of running up a daemon to run in the users name or for running a script in that users name more secure if someone managed to compromise the daemon or script that was running the with that users privilege by changing things like the users shell to /bin/false etc etc and feel free to continue the list of how best to set-up a user for this purpose alone.


cheers

/sbin/nologin is common - e.g. apache user is set to this.

My best suggestion though, if you're concerned about the possibility of a compromised system, is to implement SELinux. It has had bad press - a lot of HowTo guides will tell you to disable it - but it is worth persisting with and is getting better with later releases, such as RHEL 5.1

Yeah i've heard alot i must say about SELinux, pretty much most of the times i've posted questions regarding a security type of question. I've just not had the time to look at it in good detail but i must get round to doing that. Thanks

Still any more ideas on my above questions to everyone??? Just what sort of state is a user in thats been created but not had a passwd assigned to it. I know through testing i don't seem to be able to login to a user of that sort but i'm able to run scripts etc as that user.

Cheers