Groups > linux.debian.user > #202593

Re: ssh

From	Alan Taylor <alan.james.taylor@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: ssh
Date	2018-11-19 03:50 +0100
Message-ID	<wVHNn-47a-1@gated-at.bofh.it> (permalink)
References	(3 earlier) <wTBsK-4GS-5@gated-at.bofh.it> <wUjaq-89C-3@gated-at.bofh.it> <wUtCN-6ov-7@gated-at.bofh.it> <wV0p3-1X6-1@gated-at.bofh.it> <wVtU6-3Qi-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Thanks Mike,

I was slowly coming to that conclusion !
What would be best practice regarding a password for that account (i.e. system account such as backuppc that needs ssh access but no shell access).

If I create the user with bash as the shell, I seem to have a few options:
1) don’t set a password (i.e. no reference to password in the adduer command). The man page says this results in the password being “disabled”. What does this actually mean for security ?
2) use —disabled-password (same as 1 above ?)
3) the —disabled-password option appears to be only available on debian. Redhat derivatives only offer useradd which does not have this switch ?

Which would be the most secure, while still allowing ssh access ?

BRgds/Alan
On 18 Nov 2018, 19:50 +0800, Michael Howard <mike@dewberryfields.co.uk>, wrote:
> On 17/11/2018 04:28, Alan Taylor wrote:
> > Thanks Everyone.
> >
> > I am getting that together to show you.
> >
> > A question though - are you sure this is not normal behavior ?
> > Most of my research on the net (with caution I know) seems to suggest that ssh disconnection after authentication because of /bin/false is normal ?
> >
> >
> Yes, it is normal. A user with /bin/false as his ahell should not be able to login. These days www-data has /bin/false too, which caught be out, until I changed it back.
> --
> Mike Howard

Thread

Re: ssh David Christensen <dpchrist@holgerdanske.com> - 2018-11-13 04:30 +0100
  Re: ssh Alan Taylor <ataylor@ieee.org> - 2018-11-13 05:40 +0100
    Re: ssh David Christensen <dpchrist@holgerdanske.com> - 2018-11-13 08:40 +0100
      Re: ssh Alan Taylor <alan.james.taylor@gmail.com> - 2018-11-15 07:20 +0100
        Re: ssh David Christensen <dpchrist@holgerdanske.com> - 2018-11-15 18:30 +0100
          Re: ssh Alan Taylor <alan.james.taylor@gmail.com> - 2018-11-17 05:30 +0100
            Re: ssh Michael Howard <mike@dewberryfields.co.uk> - 2018-11-18 13:00 +0100
              Re: ssh Alan Taylor <alan.james.taylor@gmail.com> - 2018-11-19 03:50 +0100
                Re: ssh Michael Howard <mike@dewberryfields.co.uk> - 2018-11-19 08:40 +0100
                Re: ssh john doe <johndoe65534@mail.com> - 2018-11-19 09:50 +0100
                Re: ssh Michael Stone <mstone@debian.org> - 2018-11-19 14:40 +0100
                Re: ssh Jim Popovitch <jim@k4vqc.com> - 2018-11-19 15:50 +0100
                Re: ssh Michael Stone <mstone@debian.org> - 2018-11-19 18:20 +0100
                Re: ssh Jim Popovitch <jim@k4vqc.com> - 2018-11-19 19:10 +0100
                Re: ssh Michael Stone <mstone@debian.org> - 2018-11-20 03:20 +0100
                Re: ssh Greg Wooledge <wooledg@eeg.ccf.org> - 2018-11-19 14:40 +0100

csiph-web