4

Problem

In Debian 10 I want to create a user who cannot log in directly. One should only be able to access the user by using the su binary. In my Ubuntu 18.04 setup, I did exactly this and it worked like charm, but in Debian 10 I am not able to do so.

Hint

The user that is able to login will not have the permission to use sudo.

What I've done

I've setup a user with the default shell /usr/sbin/nologin. But when trying to access this user by su --shell=/bin/bash user I am not able to do so.

Minimal example

# useradd --shell /usr/sbin/nologin locked

# passwd locked
Enter new UNIX password: *secret*
Retype new UNIX password: *secret*
passwd: password updated successfully

$ su --shell /bin/bash locked
Password: *secret*
This account is currently not available.

Why does this no longer work in Debian?

Edit 1:

Output of /etc/shells:

$ cat /etc/shells
# /etc/shells: valid login shells
/bin/sh
/bin/dash
/bin/bash
/bin/rbash
/bin/zsh
/usr/bin/zsh

Edit 2:

A little more detailed answer on what I want to achieve:

I am trying to create a user (user1) that is able to login to the computer either by SSH or by using a monitor and a keyboard. This user1 user should have restricted rights. One of this restrictions is, that he is not able to use sudo application, he is simply not allowed to do so.

Then I have a second user (user2) which will be able to use the sudo application to perform some configuration tasks, like changing network settings or some other things. This user2 should be locked to log into by default. So no login by SSH and (more belonging to my problem) no login by monitor and keyboard.

--> When someone wants to perform some task he has to login as the restricted user1, change the user to user2 and then he is allowed to change some configuration or something like that.

This is all in all the situation I want to achieve. There are some, more fine grained details what the users are allowed or not allowed to do. But to describe it as simple as possible I simply explained it with `sudo.

1

2 Answers 2

3

If your user had a login shell, you would need to type in your cmd as: su --shell=/bin/bash locked or sudo -u locked /bin/bash, provided the default shell specified for the target user is listed in /etc/shell.
(Note that there is an equal sign after the long option --shell.)

However:

  1. the point of having a user with no login shell is precisely that that user cannot login in any way, be it directly at session start or via another user account. Oddly that is exactly what you are trying to achieve.

  2. to be able to access that user (provided it has a login shell, by switching to its profile as shown above, you will generally need sudo privileges, or at least be able to use the su cmd...

7
  • This seems not to work, too. Still getting the This account is currently not available. output. FYI: I've updated the initial question to contain the allowed login shells and /bin/abash is available. Jun 25, 2021 at 8:25
  • 1
    @KonradGrüner from man su: "If the target user has a restricted shell (i.e., not listed in /etc/shells), the --shell option and the SHELL environment variables are ignored unless the calling user is root."
    – muru
    Jun 25, 2021 at 17:06
  • @Cbhihe see Edit 2 in initial post for the explanation what I want to achieve. Jun 28, 2021 at 8:53
  • @muru You are right :/ This is exactly the problem I had. In Ubuntu the shell is listed in /etc/shells and in my debian it is not. So if you add it as an Answer I will mark it as correct answer. Alternative @Cbhihe can little change his answer. He also stated that the shell has to be in /etc/shells. But this does not mean that only the shell I want change to has to be listed, also the default shell of the user has to be in /etc/shells. Jun 28, 2021 at 8:56
  • @KonradGrüner "But this does not mean that only the shell I want change to has to be listed, also the default shell of the user has to be in /etc/shells" ... no, this doesn't say anything about the shell you want to change to. It's only about the target user's default shell. As long as the target user's default shell is in /etc/shells, you can use whatever command you want with --shell (e.g., su --shell /bin/date some-user will work just fine)
    – muru
    Jun 28, 2021 at 9:57
0

I found this one from ivanleoncz in Server Fault and id did work for me:

You can use the -s switch to su to run a particular shell

su -s /bin/bash -c '/path/to/your/script' testuser

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.