GNU Finger 1.35 .fingerrc problem with restricted shell

Thread View: gnu.utils.bug

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Erez "HWank1" Zadok Thu, 10 Sep 1992 03:04

#779

Author: Erez "HWank1" Zadok
Date: Thu, 10 Sep 1992 03:04

22 lines
1375 bytes

Our serverhost is one which some users are not allowed to login.  Those
users are allowed to login to all other hosts in our domain.  We do this by
setting up NIS netgroups.  On the restricted host we have at the end of
/etc/passwd:

	+::0:0:::/bin/restricted

which prints a message telling them they cannot login to this restricted
host, and exits.  On all of the other machines we have

	+::0:0:::

which lets those users a local login.

If such a restricted user on that host has a .fingerrc file, all they get
when anyone fingers them is the output from /bin/restricted, because that is
the shell that is exec-ed in the maybe_exec_as_user() function.  I had to
hack it so that if they have a restricted shell, but are valid uses on our
system, and have a .fingerrc file, finger will at least execute /bin/sh for
their .fingerrc.

Erez.

Re: GNU Finger 1.35 .fingerrc problem with restricted shell

#781

Author: James Tanis
Date: Thu, 10 Sep 1992 14:58

36 lines
1828 bytes

>>>>> On Wed, 9 Sep 92 23:04:55 EDT, ezk@chestnut.cs.columbia.edu (Erez "HWank1" Zadok) said:

	ez> Our serverhost is one which some users are not allowed to login.
	ez> Those users are allowed to login to all other hosts in our
	ez> domain.  We do this by setting up NIS netgroups.  On the
	ez> restricted host we have at the end of /etc/passwd:

	ez> 	+::0:0:::/bin/restricted

	ez> which prints a message telling them they cannot login to this
	ez> restricted host, and exits.  On all of the other machines we
	ez> have

	ez> 	+::0:0:::

	ez> which lets those users a local login.

	ez> If such a restricted user on that host has a .fingerrc file, all
	ez> they get when anyone fingers them is the output from
	ez> /bin/restricted, because that is the shell that is exec-ed in
	ez> the maybe_exec_as_user() function.  I had to hack it so that if
	ez> they have a restricted shell, but are valid uses on our system,
	ez> and have a .fingerrc file, finger will at least execute /bin/sh
	ez> for their .fingerrc.

	ez> Erez.

Although I wasn't able to get this idea working quickly, I would like to try
it sometime when I'm not exec'ing your environment on .fingerrc.  Do you
think that someone could arrange a login on cs by writing a .fingerrc

exec /bin/ksh

and then fingering user@cs?  

/jtt

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads