Restricted Shell 1

[Guest_imported]

Hi all,
Is there any way to set a user to use a restricted shell by default every time they log in. or set their environmet to be restricted.

Thank you in advance.

 

[Yegolev]

You change their startup shell to ksh -r. Use `smit chuser` to make this easy. IBM Certified -- AIX 4.3 Obfuscation

 

[Guest_imported]

Thanks for your response.

I do not see a section to be able to change the startup shell. the only thing I see that has anything to do with shell in smitty chuser is initial program which is set to /usr/bin/ksh and when I changed that to ksh -r or /usr/bin/ksh -r the system gives the error message of invalid value for ksh.

Is there anything else i have to look at.

Thanks again.

 

[AIXSPadmin]

This field is the initial program to run and must be in /etc/shells. There cannot be an entry for `ksh -r`, but you may want to try /usr/bin/rsh.

 

[Chapter11]

That user field has to be a legit value in /etc/security/login.cfg. That file won't let you have spaces, so you can't just add "/bin/ksh -r" to it.

So, I just tried creating /etc/rksh with contents:
[tt]#!/bin/ksh

ksh -r[/tt]

and added /etc/rksh to login.cfg's list of legal shells.

It probably creates an extra layer or two of extraneous ksh's, but it at least passes the control-c and control-d tests for breaking out of it.

 

[Guest_imported]

I created /etc/bin/rksh with the contents above and I added the /etc/rksh to the login.cfg file. but when I login to with that user it fails to run the shell and it disconnects me from the host.

 

[AIXSPadmin]

I am not sure, but I believe it is because the file /etc/rksh is not an actual shell, but rather a shell script.

 

[Yegolev]

Poking around in /usr/bin, I see a Rsh. Note it is different than rsh. Please ignore my previous bad advice and use /usr/bin/Rsh as your shell. IBM Certified -- AIX 4.3 Obfuscation

 

[Chapter11]

Confirming Yegolev's "Rsh" line. That's the droid you're looking for. Didn't even think to look for a capital letter!

 

[Yegolev]

Behold the power of my `ls *sh*`, young Padawan. =) IBM Certified -- AIX 4.3 Obfuscation