2

I have a client who has an install script that needs to run under /bin/tcsh as the shell on their Active Directory Domain Joined RHEL7 Virtual Machine. This install script will be run using a service account called, serviceaccount. Now, this account is granted rights because of a group it's a member of Admins.

The end user logs into the VM, sudo su serviceaccount and then runs the shell.

We have modified serviceaccount's attribute loginShell to be set to /bin/tcsh.

Now, the Unix admin team set serviceaccount's profile to be /bin/tcsh and it can be verified using the user's environmental settings. Somehow, the install script is finding /bin/bash, and it seems totally random, but it pulls incorrectly more than 95% of the time.

I don't see any shell attributes in AD Groups, nor anything else close in the user attributes, besides the loginShell.

I've also verified it's set correctly in every Domain Controller in the environment.

getent passwd serviceaccount
serviceaccount:*:123456789:123456789:serviceaccount:/home/serviceaccount:/bin/bash

(As another test, we stood up a new VM that this account has never been logged into and getent still shows /bin/bash.)

Any ideas?

9
  • 1
    Charles ge the shebang in the script to #@/bin/tech rather than setting the users shell
    – Panther
    Feb 5, 2019 at 19:52
  • how exactly is the the installer being launched?
    – Jeff Schaller
    Feb 5, 2019 at 20:02
  • The application the script is attempting to install also requires the user account to be set to /bin/tcsh, so changing the script only puts a wet band-aid on it. Thank you though.
    – Josh B
    Feb 5, 2019 at 20:04
  • 1
    The /home/serviceaccount/folder/installerscript.sh script should use a #!-line pointing to the correct interpreter. This does not need to be the user's login shell.
    – Kusalananda
    Feb 5, 2019 at 21:32
  • 1
    JoshB regardless of whether or not the end user is an admin on the box, why not just sudo -u serviceaccount -s. This does not require root privileges because there is no need for su. Your suggested command does require root privileges to run. Feb 5, 2019 at 22:01

1 Answer 1

0

pretty sure you'd be using AD auth via sssd set by authconfig. In the /etc/sssd/sssd.conf, there will be a default shell set for the AD domain/realm. That's where /bin/bash is coming from. As for setting the shell on a per account basis? not sure how to override that sssd default.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .