1

I am writing a script that would be invoked to change user shell. The basic requirement is that once user gets authenticated (e.g: thorough some web application) the script would be invoked to set the default shell. He can choose from the range of available shells. There are several questions that I don't know how to address. The first of them being -How To change shell?- I know about chsh but running the command requires that the user supply a password, and there I don't want that. Once the user is authenticated I want to run the script knowing that user is valid. Should I use the root privileges? if yes, what are the security implications of that? Also what security measures should I consider while implementing such a script? I have started with the script below, and hope to expand on that. Comments/Answers would be appreciated.

P.S: had this question posted here, then realized this forum might be the right place.

  1 #!/bin/bash
  2 
  3 #### Constants ########
  4 TOSHELL=
  5 NUMARGS=$#
  6 USER=$(whoami)
  7 #### Functions ########
  8 
  9 checkArgument(){
 10 
 11     if [ "$NUMARGS" != "1" ]
 12     then
 13         return 1
 14     else
 15         TOSHELL=$1
 16         return 0
 17     fi
 18 
 19 }
 20 
 21 
 22 changeShell(){
 23 
 24     `chsh -s $TOSHELL $USER`    
 25 
 26 }
 27 
 28 main(){
 29 
 30 
 31     if checkArgument
 32     then
 33         changeShell #Also check if changeShell was successful
 34         return 0
 35     else
 36         return 1
 37     fi
 38 
 39 }
 40 main
  • maybe sudo is what you need. – Red Cricket May 20 '15 at 14:50
  • @RedCricket You're right, now that I think about it. You could do a sudo rule that allows everyone to execute a script that only changes the shell with no password. You'd have one script that authenticates and the other that does the changes. – SailorCire May 20 '15 at 14:56
  • 1
    How are you going to verify passwords without escalated privileges? I would think that is your first task. If you run chsh as root then you aren't prompted for a password, but there is an obvious security issue with doing that. – SailorCire May 20 '15 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.