Date: 27-07-00 15:45
Even the most experienced of BSD users that I know were not able to answer what turned out to be a simple question...so in an effort for full disclosure, I wanted to share with you what I learned.
What am I going on about you ask? Well, here was my dilema. I wanted to start virtually hosting websites for some friends of mine, and in an effort to keep good security practices, I didn't want to issue shell accounts to every user I hosted. The only access the users would really ever need would be FTP only.
Something as simple as restricting access for users to FTP caused quite a stir among the upper echeleons...but over time I learned how. Instead of installing fancy FTPd software which might in and of itself be a security bug, I decided to keep what comes installed by default on Free BSD 4.0. I received all sorts of suggestions like "creating an FTP group and adding folks to that" or "make sure they aren't in the FTP users file" (the one that would otherwise DENY them to my FTP). Instead here was my solution:
Free BSD has an /sbin/nologin feature that you can place as user accounts shell login, which in essence tells the user when they shell in that their account has been suspended and immediately logs them out. Well, in my opinion it's a little well known fact that this "shell" is NOT in the /etc/shells file...meaning as far as FTP is concerned, it's not a valid shell, therefore anyone who HAS that shell in the /etc/passwd file will get denied access to FTP as well. Catching on yet?
I simply added the /sbin/nologin to the /etc/shells file as a valid shell. Now users CAN FTP into my box, but cannot shell in. End result? Along with a few FTP security rules, I can now virtually host all the sites I want without the nasty potential for root compromise via a shell login. Something so simple and yet so difficult for people at times.
I don't know if this area has been explored yet, but I know in all my quests for knowledge, I never once came across this explanation. I hope it helps all you lost souls out there like myself in the long run.