User shells being changed automagically

[shacker23]

Lately I've been getting reports from my users that their zsh, tcsh, or ksh shells have been suddenly reset to bash. Is this something new that cPanel is doing on automatic update? I've never seen this happen before, and it's quite annoying.

Thanks for any info on this.

Scot

[24x7team]

Check whether your server is infected or not.....

run rootkit on it and search common maliciuos scripts named

psybnc, sosweet and y2kupdate, etc, etc....

[chirpy]

Lately I've been getting reports from my users that their zsh, tcsh, or ksh shells have been suddenly reset to bash. Is this something new that cPanel is doing on automatic update? I've never seen this happen before, and it's quite annoying.

Thanks for any info on this.

Scot

Not something I've seen happen, but it's possible I guess. Have you tried checking the status of the shell accounts and then running /scripts/upcp manually and seeing if it changes them?

[shacker23]

Thanks Chirpy. Just tried that, and the default shells were not changed, so it looks like the problem is not in upcp. I'll monitor this and post if I can nail down any more specifics.

- Scot

[shacker23]

Doh! I just figured out what was going on here. Every now and then I'll modify packages to add more email accounts, change the cpanel skin, etc. When I do, I batch-reset users to their own package levels so that all users benefit from the new service levels.

But the default user shell is *part* of the package system. So every time I upgraded the services I offer, I was setting non-bash users back to bash without knowing it. Now that I know what's going on, I can take note beforehand and change oddball shell users back after upgrading my service plans.

[chirpy]

Aha! That can be a pain. It has its advantages, of course.The laternative is to write a script to modify account settings directly by changed /var/cpanel/users/* - depends which is more work