/etc/passwd file, I can see that the
www-data user used by Apache, as well as all sorts of system users, have either
/bin/false as their login shell. For example, here is a selection of lines:
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin games:x:5:60:games:/usr/games:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin syslog:x:101:104::/home/syslog:/bin/false whoopsie:x:109:116::/nonexistent:/bin/false mark:x:1000:1000:mark,,,:/home/mark:/bin/bash
Consequently, if I try to swap to any of these users (which I'd sometimes like to do to check my understanding of their permissions, and which there are probably other at least halfway sane reasons for), I fail:
mark@lunchbox:~$ sudo su www-data This account is currently not available. mark@lunchbox:~$ sudo su syslog mark@lunchbox:~$
Of course, it's not much of an inconvenience, because I can still launch a shell for them via a method like this:
mark@lunchbox:~$ sudo -u www-data /bin/bash www-data@lunchbox:~$
But that just leaves me wondering what purpose is served by denying these users a login shell. Looking around the internet for an explanation, many people claim that this has something to do with security, and everybody seems to agree that it would be in some way a bad idea to change the login shells of these users. Here's a collection of quotes:
Setting the Apache user's shell to something non-interactive is generally good security practice (really all service users who don't have to log in interactively should have their shell set to something that's non-interactive).
the shell for the user www-data is set to /usr/sbin/nologin, and it's set for a very good reason.
[system accounts] can be security holes, especially if they have a shell enabled:
For security reasons I created a user account with no login shell for running the Tomcat server:
# groupadd tomcat # useradd -g tomcat -s /usr/sbin/nologin -m -d /home/tomcat tomcat
While these posts are in unanimous agreement that not giving system users real login shells is good for security, not one of them justifies this claim, and I can't find an explanation of it anywhere.
What attack are we trying to protect ourselves against by not giving these users real login shells?