Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 6 ■ SECURING YOUR SYSTEMS2. These users are then added to /etc/password, with the shell set as/bin/nologin (thus overriding the LDAP data):user1:x:3434:102:User Name:/disk/raid/userdir:/bin/nologinThe second field points to /etc/shadow for the password; the third and fourthfields are the userID and groupID, which you’ll need to get out of LDAP withldapsearch "(uid=user1)". The sixth field sets their home directory, which inthis case is their user directory on the RAID array (or whatever other big disk isbeing used for laptop backup purposes). The seventh field is the one that setsthe shell to /bin/nologin.3. They’re also added to /etc/shadow, with *K* (meaning “use Kerberos”) as thepassword. This avoids maintaining two sets of passwords, which is a bad idea:user1:*K*::::(Since you’re getting password information from Kerberos, you can leave allthe fields in /etc/shadow other than the username and password blank—youneed four colons after the *K*.)4. /bin/nologin looks like this:01 #!/bin/sh02 # Script to disallow remote login - set as shell in /etc/passwd03 # JK 03.04.200904 command=$205 if (expr "$command" : 'rsync ..server .* .raid' > /dev/null)06 then07 if (expr "$command" : '.*;' > /dev/null)08 then09 exit10 else11 /bin/sh "$@"12 fi13 else14 echo "***********************************"15 echo "* No login allowed! *"16 echo "***********************************"17 exit18 fiLines 04 and 05 test to see whether the command being used is one that looksroughly like rsync directory/ server:/raid. The trick I used for finding thecommand that’s being sent (which is not the same as the command that youtype on the command line when you use rsync!) was to first set up/bin/nologin simply as this:#!/bin/shecho $@ > /tmp/commandexitand then examine /tmp/command on the rsync server. $2 is the second argumenton the line in /tmp/command.139Download at WoweBook.Com