LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 04-16-2014, 03:11 PM   #1
kfrank
LQ Newbie
 
Registered: Apr 2014
Posts: 3

Rep: Reputation: Disabled
Changing the shell for users on LDAP auth server


Hi,

I'm trying to change the default shell for a group of users on an ubuntu 12.04 server. The server uses LDAP to create and authenticate users so these people aren't in /etc/passwd which leads to

root@tgit001:/home# chsh -s /usr/bin/git-shell user1
chsh: user 'user1' does not exist in /etc/passwd
root@tgit001:/home# usermod -s /usr/bin/git-shell user1
usermod: user 'user1' does not exist in /etc/passwd

I've tried changed the default shell by overriding the ldap attribute for the login shell in /etc/ldap.conf

nss_override_attribute_value loginShell /usr/bin/git-shell

I then restarted nscd (don't ask me why I was following someone else's post). Thought that would change the shell system-wide for LDAP accounts but nothing changed.

Then I tried adding peeps to /etc/passwd manually with a script I wrote

Code:
for i in `ldapsearch -xLLL cn=groupNeedingDiffShells | grep memberUid | cut -d ' ' -f 2`; do
    if [[ "$i" != "boss1" ]] && [[ "$i" != "boss2" ]]; then
        echo "Provisioning git-shell environment for $i..."
        if grep --quiet "$i:" /etc/passwd; then
            echo "$i is already in /etc/passwd"
        else
            echo `getent passwd $i` >> /etc/passwd
        fi

        /usr/sbin/usermod -s /usr/bin/git-shell $i

        if [ ! -d /home/$i/git-shell-commands ]; then
            /bin/cp -R /usr/bin/git-shell-commands /home/$i/
            /bin/chown -R $i:$i /home/$i/git-shell-commands
            /bin/chmod -R 755 /home/$i/git-shell-commands
        fi

    fi
done

The above script works but my boss shot this down since he doesn't want me adding entries manually to /etc/passwd. So I guess my questions are

1. Is adding entries to /etc/passwd manually advisable in this scenario? What are some potential problems that may arise?

2. I don't want to change the loginShell attribute in LDAP for those users since we have a bunch more instances where a bash shell is needed. Is there some way to set a system-wide default shell? Or another command to change a user's shell that will work for LDAP users?

THanks
 
Old 04-17-2014, 08:35 AM   #2
YankeePride13
Member
 
Registered: Aug 2012
Distribution: Ubuntu 10.04, CentOS 6.3, Windows 7
Posts: 262

Rep: Reputation: 54
If a user needs to run some programs in a different shell, they could just throw it in a shell script and execute it that way. Just have to change the shabang line to the type of shell you need.
 
1 members found this post helpful.
Old 04-17-2014, 11:29 AM   #3
kfrank
LQ Newbie
 
Registered: Apr 2014
Posts: 3

Original Poster
Rep: Reputation: Disabled
I'm sorry I don't think I gave enough context.

So we want a group of users to only have a git-shell. That way they will only be able to execute git commands and nothing else once they log in. We don't want them to have any other shell access other than a git-shell.
 
Old 04-17-2014, 02:08 PM   #4
kfrank
LQ Newbie
 
Registered: Apr 2014
Posts: 3

Original Poster
Rep: Reputation: Disabled
OK so I found a solution but it's kind of a hack job. Putting it here just for future reference.

For each user in the LDAP group that we want to have git-shells, put a .profile in their home dirs with this line:

Code:
SHELL=/usr/bin/git-shell exec /usr/bin/git-shell
This opens up a git-shell for that user at login and never lets them have a bash shell. We're not going to use this however - turns out the way users are being created on that instance is screwy. We're working on fixing that rather than hacking together a way to give out git-shells to peeps right now.
 
Old 04-20-2014, 11:33 AM   #5
btmiller
Senior Member
 
Registered: May 2004
Location: In the DC 'burbs
Distribution: Arch, Scientific Linux, Debian, Ubuntu
Posts: 4,284

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Why not just use ldapmodify to change the loginShell entry of each DN (user) that you want to restrict to git-shell? That seems a lot more straightforward than your method and less error-prone too. Note, you may need to add /usr/bin/git-shell to /etc/shells.

If the users need to authenticate on a different server where they need a real shell, there are ways to do it. I've never used nss overrides, but on one system I have:

Code:
map passwd loginShell "/bin/bash"
to force all LDAP users' shells to be /bin/bash on that particular server.

There is a way to filter such that the mapping is only used for some users (but I've never used this), e.g.L

Code:
filter passwd "(gidNumber=12345)"
map passwd loginShell "/usr/bin/git-shell"
This would make the shell of all users with a primary GID of 12345 /usr/bin/git-shell, if I read the documentation correctly.

I set these in /etc/nslcd.conf on the system. There are a couple other options. If you're using nslcd, you might check it out. I'm not sure if there's similar functionality in nscd or sssd.
 
Old 06-04-2015, 12:01 PM   #6
masoudmmf
LQ Newbie
 
Registered: Jun 2015
Posts: 1

Rep: Reputation: Disabled
chsh: user '' does not exist in /etc/passwd

if you are using LDAP authentication by PAM or something, you have to find your answer in your LDAP Server , let's aim it for Microsoft AD , in this case your domain account is not in /etc/passwd when you login , but you can see your user property in AD , by #getent passwd | grep user , if at the end it shows your shell is /bin/csh that's because in your AD there is a attribute for that, so if you have administrator account on AD , you can fix it your self otherwise just say it to your AD admin to , enable advance features in View tab of Active directory users and computers > user properties > UNIX attributes > change the login shell to /bin/bash

be sure you didn't forgt :
sudo /opt/pbis/bin/config LoginShellTemplate /bin/bash

if you used likewise or .. for join

done!
http://fereidonian.net/?p=52

Last edited by masoudmmf; 06-04-2015 at 08:10 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How do I setup LDAP auth of users/groups on Debian 5.0? peterson.julia Linux - Newbie 1 08-08-2010 12:29 AM
Apache LDAP auth with local users - getting warnings - possible to suppress? laggerific Linux - Software 1 08-18-2009 06:32 PM
Samba auth against a external LDAP server rafa_gallego Linux - Server 1 10-16-2008 03:56 PM
ldap as auth server, users sometimes unknown ?? rhoekstra Fedora 2 09-05-2005 01:39 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 04:15 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration