Home / server / Questions / 761586
Accepted
KallDrexx
Asked: 2016-03-05 06:05:04 +0800 CST

How can I prevent shell access on a user account but show a custom message instead (on linux)?

  • 772

For various reasons, I need to enable telnet access (over the private network), and when someone tries to log in with a specific user account (lets say CheckStatus), instead of giving the user a shell it instead runs some very very quick code/script/whatever and returns one of two very specific strings. This account can have a password on it.

I'm essentially trying to replicate what happens when you try to SSH into Github's servers, where they tell you shell access is not granted.

I thought the solution to this would be to replace the user's shell, so I created the script: 

#! /bin/bash

echo "HI!!!"

then tried to set it as the user's shell via:

test@development-1:~$ chmod +x test.sh
test@development-1:~$ chsh
Password:
Changing the login shell for test
Enter the new value, or press ENTER for the default
        Login Shell [/bin/bash]: /home/test/test.sh
chsh: /home/test/test.sh is an invalid shell

Any ideas on the best way to do this?

For reference, most of our systems are Ubuntu 14.04.

linux

1 Answers

  1. Best Answer

    The best way to do this is to use ssh and tie the key to a specific command using the 'command=...' restriction embedded in the public key.

    chsh: /home/test/test.sh is an invalid shell

    The documentation helps here from chsh(1)

    NOTE The only restriction placed on the login shell is that the command name must be listed in /etc/shells, unless the invoker is the superuser, and then any value may be added.

    You need to run chsh with suitable permissions or add a suitable entry into /etc/shells.

    • 4