Subject: Re: Restricting remote access for a user
To: Jeremy C. Reed <quadreverb@yahoo.com>
From: Richard Rauch <rrauch@math.ukans.edu>
List: netbsd-help
Date: 08/14/2002 21:02:22
Re. http://mail-index.netbsd.org/netbsd-help/2002/08/12/0020.html

(Please include me directly in replies, and address to me as
``rauch@math.rice.edu'', *not* ``rrauch@math.ukans.edu''...)

/sbin/nologin is the standard "no account" shell to use, isn't it?

(Though arguably this isn't what you want.  Depends on whether you want to
be able to ``su -l ...'' or just ``su ...'' to the user.  I always like to
use ``-l'' because I mentally push some state information when I change
users, and I like to have a fresh stack frame to work in.  (^&  If you
like to ``su -l'', too, you might set the user's shell to whatever you
like and have the login script check whether the user is remote or not...
If you'll rarely su to the user, though, and never do much through that
uid, then this is perhaps more hassle than it's worth.)


  "I probably don't know what I'm talking about." --rrauch@math.ukans.edu