X11 auto login and disable users shell

drkstr · 08-05-2006, 06:52 PM

I set up an auto login to X by editing my /etc/inittab as follows:

Code:

x1:4:wait:/etc/rc.d/rc.xinit

then I created an rc.xinit wich contains this:

Code:

#!/bin/sh
startx -- -bpp 24 | su - webuser

This works like I want it to, but then I decided to disable the users shell since I would like them to never be able to enter in a command (I'm a horible person, I know).

I don't know of any "official" way to do this, so I gave this a shot:

Code:

usermod -s /dev/null webuser

But since I am essentially wrapping init 4 through the shell, this stops X11 from loading.

Does any one know of a better way to do either of these things so I can have my cake and eat it to?

thanks!
...drkstr

PS: sorry for any typos, it's a pain typing on this tiny keyboard.

**edit**
fixed the pretend | char with a real one now that I'm at a real keyboard

Daga · 08-06-2006, 06:18 PM

Quote:

Originally Posted by drkstr

I set up an auto login to X by editing my /etc/inittab as follows:

Code:

x1:4:wait:/etc/rc.d/rc.xinit

then I created an rc.xinit wich contains this:

Code:

#!/bin/sh
startx -- -bpp 24 | su - webuser

Um... how does that work? Piping startx through a command prompt? Wouldn't it be more appropriate to try this:

Code:

HOME='/home/webuser'
sudo -u webuser /bin/bash /usr/bin/startx

drkstr · 08-08-2006, 12:12 AM

Quote:

Um... how does that work? Piping startx through a command prompt?

You don't like my clumsy work around? I think it essentially does the same thing as your command, but I could be wrong.

Regardless, I will probably not be able to do this in any form if I am to disable the users shell. I was trying to avoid having to install KDM to use their built in auto login feature, but I guess I will have to give in to the bulk. Oh well, so goes life.

Thanks for the response!
...drkstr

Daga · 08-08-2006, 12:43 AM

Actually, I tested my command on a Ubuntu VM I had laying around before posting it. It works with a user shell of /bin/false

EDIT: I also tried your command. Opening a shell and typing "whoami" in X returned "root." I wasn't just scoffing

drkstr · 08-08-2006, 01:34 AM

Quote:

Actually, I tested my command on a Ubuntu VM I had laying around before posting it. It works with a user shell of /bin/false

Sweet, I'll give it a shot, thanks. I would have tested it myself but I broke the entire system a bit ago and have to rebuild it. When I get to the X part, I will use your method.

Quote:

I also tried your command. Opening a shell and typing "whoami" in X returned "root." I wasn't just scoffing

That's odd. I didn't try opening a shell, but my gui apps did not have root access. For instance, I could not browse /root in firefox but I could browse the users home. I know the xserver is always run as root, but this shouldn't cause an open shell to start off in root. Ugh, talk about security whole to the hundreth power. Kind of defeats the purpose of disabling the users shell when they get the root shell by default

thanks again!
...drkstr

drkstr · 08-26-2006, 02:26 PM

Hi Daga,

Just wanted to let you know I finally got around to testing your method. You were right, it works much better then the one I came up with. However, I did have to add the PATH to the script on my system. Once I did that, everything worked just like you said it would.

Code:

#!/bin/sh
#/etc/rc.d/rc.xinit
HOME='/home/webuser'
PATH='/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/X11R6/bin'
sudo -u webuser /bin/bash /usr/X11R6/bin/startx

Thanks for the help!
...drkstr

**edit**
PS: funny sig.

gnashley · 08-29-2006, 03:35 AM

The difference is that startx is being executed in a separate process.

Your original code may do what you want if you add 'exec':
exec startx ...

Also, you might play with disabling the alternate terminal for runlevel 4 in inittab.

drkstr · 08-29-2006, 10:36 AM

Quote:

The difference is that startx is being executed in a separate process.

Your original code may do what you want if you add 'exec':
exec startx ...

Oh, that makes sence. Thanks!

Quote:

Also, you might play with disabling the alternate terminal for runlevel 4 in inittab.

Are you referring to tty6? If so, I think I (hopefully) disabled this by uncomenting these in my xorg.conf:

Code:

Option     "DontVTSwitch"
Option     "DontZap"

Should this do the trick?
...drkstr

Daga · 08-29-2006, 11:59 AM

Yep, that should do the trick. Also there is a comment in the inittab from PV (dunno if it is still accurate, probably is) about a 1% constant CPU usage if there are no VTs.

It would be a good idea to force a shutdown when X closes (edit startx), because there have been a couple exploits in the last year that can crash X.

It is possible to get the original code working with a fake shell, but piping it through sudo isn't going to make the program run with the permissions you tell sudo to run with...

HTH,

EDIT: Thanks for the comment on the sig!

theYinYeti · 08-29-2006, 01:16 PM

You may be interested in my "autologin" page on my site (see below, as links to self-made site are forbiden...). It describes a simple method for autologging a given user. Then as you say, you can use /bin/false for the shell.

Yves.

drkstr · 08-29-2006, 01:54 PM

Quote:

Originally Posted by Daga

Yep, that should do the trick. Also there is a comment in the inittab from PV (dunno if it is still accurate, probably is) about a 1% constant CPU usage if there are no VTs.

I should be okay since the VT is still there, you just can't switch to it. At least I think that's what's going on. I'm sure there's some way to verify this when I get a chance.

Quote:

Originally Posted by Daga

It would be a good idea to force a shutdown when X closes (edit startx), because there have been a couple exploits in the last year that can crash X.

Hmm, exploits are no good. I'm hoping it will not be exploitable since the window manager is pretty limited in what the user can do. They can't even shut it down unless they know the correct key combination (which is bount to 'sudo init 0/6'. Wouldn't hurt to have a failsafe though. I briefly looked through the startx script and didn't see any "on shutdown" section, but I will try to read up on it a bit.

Quote:

Originally Posted by theYinYeti

You may be interested in my "autologin" page on my site (see below, as links to self-made site are forbiden...). It describes a simple method for autologging a given user. Then as you say, you can use /bin/false for the shell.

Interesting. This also seems like a good way to do it. I'll give it a try if the method I'm currently using stops working the way I want it to.

Thanks for everyone's replies!
...drkstr