Here's my original post:
> I'm trying to block a single user from using one of our machines. The
> machines are running 4.1.1b and NIS. The machine's passwd file
> contains a '+::0:0:::' at the end of it to allow all NIS users access.
> Well I re-read the man page for the passwd file (many times I might
> add) and it implies that I can add '-user:' to the passwd file and
> block this guy. Well it only seems to work when I remove the '+'
> record. This is not what I want... Once I remove the '+' record no NIS
> user can access the machine anyway! I really don't want to have to
> specify all other NIS users with individual '+' records, this would be
> a pain to keep updated!
>
> Am I missing something here? Or is it a bug...
The summary:
Ok here's how to block a user -- well actually here are lots of ways
to block a user! My problem was caused by not supplying enough in the
'-' entry, '-user:' isn't good enough, but '-user::0:0:::' is. Also
the uid and gid fields can be any number.
There are two main ways to do it, one is to not let the guy on and the
second is to let him/her on but change the shell. Both methods work in
environments with and without NIS.
The "Don't Let The Guy on" method:
This method consists of changing the password to a '*' or other
printable string of characters -- eg:
These '+' entries have to be before the final '+::0:0:::'
1. +user:*: -- this means the guy can't telnet in, but if he/she
can login to a trusted host (a host in
/etc/hosts.equiv), then rlogin lets him/her in.
2. -user::0:0::: -- this one stops telnets and rlogins, note the uid
and gid fields are filled in -- they must be
filled in for it to work (any digits work).
3. Make a copy of the users NIS passwd entry and insert it into
the passwd file, then change the passwd to '*' this doesn't
stop the 'rlogin' from a trusted host. Note there is no '+' or '-'
ahead of the name, the entry is 'local'.
The "Change The Shell" method:
This method consists of changing the shell of the user to something
that might just log them off, or print a message and log them off --
eg:
These '+' entries have to be before the final '+::0:0:::'
1. +user:::::/bin/true -- just exits on the guy
2. +user:::::/bin/nologin -- see below for examples of nologin shells
3. make a copy of the users NIS passwd entry and insert it into
the passwd file, then change the users' shell. Remember, no '+' or '-'
signs.
Examples of the "nologin" shell:
From: <doug@perry.berkeley.edu> Doug Neuhauser
#! /bin/csh -f
echo "You can not login on this system."
exit 1
From: <lemke@MITL.COM> Kennedy Lemke
#!/bin/sh
trap "exit 0" 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
PATH=/bin
ADMIN=sysadmin
(/bin/date;echo "User $USER logged into `hostname`") | /usr/ucb/mail -s "login" $ADMIN
echo ""
echo "Login access to `hostname` is restricted for user $USER"
echo "Contact Kennedy if you need to be able to log into this machine"
echo ""
sleep 5
exit 0
From: <cfoley@arsenic.cray.com> Charles Foley
#!/bin/sh
/usr/bin/echo 'User access denied.'
exit
*************************************************************************
There may be other ways that I haven't seen or permutations on these. There's the
double kill method which combines the two distinct methods. There were 35 responses
in around 12 hours... good action if you ask me...
Thanks go out to:
zeke@mpl.UCSD.EDU (Rob Scott)
duc@bluzman.sps.mot.com (Duc Vu)
judy@qucis.queensu.ca (Judy Russell)
stanley@oce.orst.edu (John Stanley)
Sjoerd Mullender <sjoerd@cwi.nl>
doug@perry.berkeley.edu (Doug Neuhauser)
dan@BBN.COM
bob@kahala.soest.hawaii.edu (Bob Cunningham)
lemke@MITL.COM (Kennedy Lemke)
mikem@juliet.ll.mit.edu ( Michael Maciolek)
Jonathan Corbet <corbet@stout.atd.ucar.EDU>
jimh@nsd.fmc.com (Jim Hendrickson x7348 M233)
lsf@holmes.astro.nwu.edu (Sam Finn)
jeg@ced.berkeley.edu (James Ganong)
bill@ihpds1.att.com (Bill Duncan)
johnb@edge.CIS.McMaster.CA (John Benjamins)
nicky@davinci.concordia.ca
kpc!kpc.com!cdr@uunet.UU.NET (Carl Rigney)
deltam!dm!mark@uunet.UU.NET (mark galbraith)
ian@whistler.sfu.ca (Ian Reddy)
casper@fwi.uva.nl (Casper H.S. Dik)
cfoley@arsenic.cray.com (Charles Foley)
bien@aero.org
long-morrow@CS.YALE.EDU
erueg@cfgauss.uni-math.gwdg.de (Eckhard Rueggeberg)
boudreau@macgyver.crim.ca (Guy Boudreault)
"Matt Crawford" <matt@oddjob.uchicago.edu>
phil@pex.eecs.nwu.edu (William LeFebvre)
VINCE@UCONNVM.UCONN.EDU
exuksm@exu.ericsson.se (Karl Morgan)
alek@spatial.com (Alek O. Komarnitsky)
pag@scg.boulder.co.us (Peter Gross)
john@mlb.semi.harris.com (John M. Blasik)
dmose@bright.uoregon.edu (Dan Mosedale)
"Andrew Luebker" <aahvdl@eye.psych.umn.edu>
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:06:17 CDT