TIP: Disable shell accounts

faq
search
add article
cool-stuff
how-to
main
tips

TIP: Disable shell accounts

Posted by Jason on Monday March 18, @12:31PM
from the dept.
If you have a server used for email and your users do not need shell accounts, you should disable their shells by setting them to nologin.

When you create a user, their default shell is set to /bin/sh which grants them the ability to logon to the system and receive a shell prompt. If their shell account is enabled and their account information is compromised, a cracker could potentially login to the system using their credentials- which would be bad! Since a shell account is not necessary for a user to send and receive email, this feature can be disabled for increased security.

When you create a new user, simply set their shell to /sbin/nologin.

To change the shell account for an existing user, you can use the chpass utility. If you login as root and issue the following command, you will disable the given user's shell account:

chpass -s /sbin/nologin {username}

To re-enable a shell account, you can issue the same command but with the proper shell information:

chpass -s /bin/sh {username}

Note: To learn more about the chpass utility and the unix shell, try the man pages.

man chpass
man sh
man tcsh

< | >

Related Links

Articles on Security and Firewalls
Also by Jason
Contact author

If you have ever wanted to learn about Cisco Routers, check out my new book "Cisco Routers for the Small Business" - it's Cisco CLI for the Regular Guy!

Sponsors

The Fine Print: The following comments are owned by whoever posted them.
( Add a Reply )

"You never know how many friends you have until you own a Condo on the beach." -- Jason's Postulate

[ main | post article | search ]