24
votes
3answers
1k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
0
votes
1answer
57 views

Faillog - unsuccessful login count in Motd

I wish to include a count of failed login attempts whenever a user logs in. I've created: /usr/local/bin/dynmotd which contains #!/bin/bash FAILLOG=`faillog -u` echo -e " $FAILLOG " and ...
2
votes
2answers
54 views

Is it secure to connect remotly to Mysql using shell?

I have created a shell script to connect to a DB and do some queries: #/!bin/bash ... ... mysql -h remote -u root --password='pw' MatchingDB some SQL queries My question is : Is this connection ...
2
votes
2answers
74 views

In OS X Darwin, why can I interfere with text input across user sessions using cat?

OS X Darwin: Disrupting Terminal Sessions Across User Identities How, in Brief: with cat < /dev/ttys_, in Terminal. My Question This OS X 10.9.2 Darwin behaviour seems odd to me, and I would ...
2
votes
2answers
683 views

Do I need to encapsulate awk variables in quotes in order to sanitize them?

As per an answer on stackoverflow, it's my understanding that encapsulating bash variables in double-quotes is a fairly safe way of sanitizing user input. What about awk variables? For example, if ...
4
votes
1answer
633 views

Using LDAP for authentication, how can I safely disable/deactivate an account without deleting it?

We use LDAP for authentication for thousands of users. The primary tactic we have been employing to make a user unable to login, without removing their account, is to change the LDAP attribute ...
3
votes
1answer
185 views

present users a login prompt? /bin/login? getty?

I have a service that execs a command when a user connects to it through a socket, and redirects everything it receives to the executed program. It works ok with shells like bash, giving the user a ...
8
votes
2answers
1k views

How can you log every command typed

How can you log every command someone has entered into the shell? I'm asking on both the basis of protecting yourself if you are logged into someone else's server and something breaks, or if someone ...
2
votes
3answers
4k views

Why do I get error “Could not chdir to home directory”

I work in support, and occasionally I'm given shell access to a remote Linux system. I frequently find that when the admin gives me remote access, that I get the following output upon login. ...
3
votes
2answers
1k views

How to prevent command injection through command options?

I have an wrapper application where I need to let the user specify custom options to pass to a simulator. However, I want to make sure the user doesn't inject other commands through the user options. ...
1
vote
2answers
173 views

How to make sure the shell builtin echo is invoked so that its not visible in process list?

Is this going to be visible in the process listing if the below line is executed from a command line or a shell script bash -c "echo $password" or i just need to do echo $password from within ...
9
votes
3answers
1k views

Is it safe to close shell just by clicking “X” or using “ctrl+d”?

Is it safe to close shell just by clicking "X" or using "ctrl+d" while logged in as root with su or is it safer to close it by typing "exit"? Is there any difference (security-wise) at all or is it ...
5
votes
3answers
283 views

Preventing binary planting attacks in Linux

If a user account on a Linux machine is compromised, clearly, all files owned by that user are compromised. Unfortunately, if the compromised user also has sudo privileges, it seems that binary ...
7
votes
5answers
4k views

Shell Script mktemp, what's the best method to create temporary named pipe?

I'm aware its best to create temporary files with mktemp, but what about named pipes? I have an idea, I'm sure it would work, but I would really like an expert opinion. I prefer things to be as ...
36
votes
7answers
28k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
6
votes
1answer
733 views

Why root's default shell is configured differently with other normal user account's default shell?

As I know, root's default shell is configured csh and normal user's default shell is sh in FreeBSD. And in Ubuntu, root is dash, normal user is bash. (refer: What's the Ubuntu's default shell?) Why ...
6
votes
2answers
3k views

Write to a file without redirection?

I am writing a regular compiled application that needs to create a special file and write a magic cookie into it. I can’t write the file directly from the application, the system security model ...
4
votes
1answer
129 views

How can I run keychain in a way that only has the first shell prompt for keys on startup?

I open multiple shell tabs when I start KDE, and I've just added keychain to my ~/.shellrc the problem is that all the tabs prompt for key passwords when I login. This is quite annoying to do this. Is ...
57
votes
5answers
33k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...