RE: non-login accounts
Curt Sampson (curt@portal.ca)
Fri, 2 Aug 1996 13:21:38 -0700 (PDT)
> Does this necessarily have to be a c program? Can it be a regular shell
> script? I read somewhere that using a shell script to do something like
> this creates a security hole. I was thinking something in the lines of
> using a shell script to echo the message you have above, then calling
> passwd so that the only thing users can do when telnetting in is changing
> their password. What do you think?
If they can telnet in at all, they can use ftp to upload a new .profile
or .bashrc or whatever that may get run before the shell does, in which
they could do other things.
cjs
Curt Sampson curt@portal.ca Info at http://www.portal.ca/
Internet Portal Services, Inc.
Vancouver, BC (604) 257-9400 De gustibus, aut bene aut nihil.