2

On SLES 11 SP 2 I found out with webmin that lot of default users have the /bin/bash setting which in principle allows them to run in a SSH shell.

I consider it as a possible security risk.

My question:

Can I safely change for all the users in the below list the Shell setting to bin/false in order to disable any SSH connection?

enter image description here

  • I suppose that those users does not have a password set before. Because they mostly belong to a service for process ownership. The default behavior of SSH daemon is not to accept connections for blank passwords. That's why you do not need to change the default shells of those user. But still if you would like to change the shells, you can change them by modifying the /etc/passwd file. It would be better to set /sbin/nologin. – LittleSmurfie May 21 '17 at 13:23
3

Beware that setting a user's login shell to /bin/false (or /bin/true or /sbin/nologin which has the very minor benefit of displaying a custom message) breaks su to that user. Some system scripts may be using su.

Setting a user's shell to a program that does nothing is a security benefit, but only if the user would otherwise be able to log in due to a misconfiguration. A system user should have no way to authenticate, in which case the shell setting does not matter. So it's a good idea, but only if it doesn't break anything.

You can disable SSH access for some users in another way: by adding a DenyUsers directive in /etc/sshd_config. This will prevent those users from logging in over SSH, but won't prevent logging in through another service if that service is misconfigured.

Another way to block login to an account is through PAM. The advantage of this method is that you can have different settings for each service, e.g. allow su (which will only work for root if the account has no password) and disable anything else. You can use the pam_access module to deny certain users.

0

Rather than changing these account shells to /bin/false, I would recommend that you change them to /sbin/nologin or whatever path nologin is on SLES 11.

  • Doesn't make a lot of difference. – Gilles May 21 '17 at 23:07
  • @Giles. /sbin/nologin is what RHEL uses. Are you saying Red Hat got it wrong all these years? – fpmurphy May 22 '17 at 6:39
  • No, nologin isn't wrong, it's better than false, but only a tiny little bit better. – Gilles May 22 '17 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.