Script as login shell

From: Robert Kane (rkane_at_scs.carleton.ca)
Date: 10/04/04 

Date: 4 Oct 2004 15:15:23 GMT

Good afternoon,

   I have a quick question. I'm in the process of putting in place a short
shell script as a login script for certain users. The script simply checks
where the user is logging in from and then dumps them into an appropriate
shell based on that information. Checking the web reveals that using a shell
script as a login shell is possibly dangerous for the following reasons:

    1) When logging in via telnet environment variables are inherited. Is
this still relevant with SSH though? I don't believe so, but I could be
wrong.

    2) If the script is setuid the user can hijack it and become root. The
script isn't setuid though, so I'm assuming this isn't a problem.

    3) The user can exit out of script and gain script. This doesn't bother
me _too_ much, as I'm just dumping them to a shell eventually anyway just so
long as they don't get administrative privileges.

    4) The user can subvert the script if it doesn't use absolute paths.
Mine does though and it runs as the user anyway.

Am I more or less OK security wise (as I believe) or am I missing something.

Thanks,
Rob

Relevant Pages

  • Re: detect shell script language
    ... In the 'old' days, when a user typed in a command, the interactive shell would immediately pass it off to 'exec' to execute. ... So, on return from exec with an error status, the shell would fork a copy of itself to try and run the script. ... As a result of the above, it was hard to tell whether the script was a Bourne shell or C shell, so the convention was introduced of using the Bourne shell no op command, as the first line in a Bourne shell script. ...
    (Debian-User)
  • Re: Call for input on comp.unix.shell FAQ
    ... >> questions and just tell people to FAQ it. ... The other level is how to write shell scripts. ... How can I remove whitespace characters within file names? ... Why one shouldn't use "echo" in a script? ...
    (comp.unix.shell)
  • SHELLdorado Newsletter 1/2003 - July 6th, 2003
    ... The "SHELLdorado Newsletter" covers UNIX shell script related ...
    (comp.unix.questions)
  • SHELLdorado Newsletter 1/2003 - July 6th, 2003
    ... The "SHELLdorado Newsletter" covers UNIX shell script related ...
    (comp.unix.shell)
  • Re: Affecting Institutional Change (Yeah Right)
    ... provides labs in most non-dorm buildings replete with the wonderful ... be run from a shell, no idea what an executable was, and, in fact, ... IDE program, go through a ton of menus to pick the right script, go ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)