users default shell is /bin/bash !!!! security ??

forlinuxsupport

Well-Known Member
PartnerNOC
Dec 22, 2004
386
0
166
cPanel Access Level
Root Administrator
Hi

I just had alook and when you create a new domain it has the box ticked for Shell access, bit silly to have it ticked by default, but not too serious I suppose.

My main concern is all email users have their shell set to /bin/bash .... surely this cant be right !!!!
take a look in /etc/vmail/passwd.domainname.co.uk
(its symlinked to /home/domainname/etc/longdomainname/passwd)

All email users have a shell by default !!!! eeeek !!!! :confused:
Please tell me im dreaming ???!!!!!????

I can't find a way to give them an invalid shell via the interface..
Should I just set them to something like /dev/null or /bin/nologin .. hmm wonder what that will break .!!

any comments,, please feel free.

What is the Jailshell and how does it work ???

thanks
andy
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,437
33
473
Go on, have a guess
No, they don't. SSH doesn't use those files for authentication - it uses /etc/passwd (/etc/shadow).

If you don't want to give real shell access, then use Packages in WHM. If you want the shell to default to jailshell use the setting for that in WHM > Tweak Settings.
 

forlinuxsupport

Well-Known Member
PartnerNOC
Dec 22, 2004
386
0
166
cPanel Access Level
Root Administrator
ahhh .. nice one...

thanks.. puts my heart at ease :) :p

What about this jailshell.... Is it worth using ?

I dont want any users to have ssh access to the server (except me of course (root)), must I set all users to jailshell, or can I put their shells as /bin/nologin ?

thanks
andy
 

RizyDeWino

Well-Known Member
Aug 1, 2005
74
0
156
Planet Earth
Jailshell is a very good restricted shell option available with whm/cpanel servers , that you can give your users access to without any worry.

Hosting clients, when granted shell access, should not be able to see anything except for their domain, their own files, and their own folders. They should feel like they are the only ones on the system. And this is what jailshell do. The users will have a restricted shell access.

Jailshell also keeps your clients from even attempting anything malicious or overstepping their bounds, because they dont have the rights to open files that they shouldn't, because they are invisible to them due to the restrictions built in the Jailshell.
 

RizyDeWino

Well-Known Member
Aug 1, 2005
74
0
156
Planet Earth
Go to WHM > Account Functions > Manage Shell Access , and simply press the 'Disable' button for both shells for each account.
 

forlinuxsupport

Well-Known Member
PartnerNOC
Dec 22, 2004
386
0
166
cPanel Access Level
Root Administrator
Hi

Here is an extract of my passwd file :
root:x:0:0:root:/root:/sbin/bash
postgres:x:26:26:PostgreSQL user:/var/lib/pgsql:/bin/bash
ftp:x:50:50:FTP User:/home/ftp:/bin/bash
cpanel:x:32001:503::/usr/local/cpanel:/bin/bash

wwwdive:x:32002:504::/home/wwwdive:/bin/bash
tekdive0:x:32003:505::/home/tekdive0:/bin/bash
secure:x:32004:506::/home/secure:/bin/bash
Can I change postgres and ftp and cpanel to /bin/false ?
Surley they never login ??

The bottom 3 are the main domain users, can I change them to /bin/false as well ?
They never use ssh, I only want root to be able to SSH in.

If I change them all to /bin/false will it affect anythign else ?

thanks for the help
Andy