Re: How to trap !sh at keyboard

Unless you have some modified version of shutdown, only root should be able
to run it anyway. So, for a user to type !sh and get the box to shutdown,
they'd have to be logged in as root or knowingly type "sudo !sh" if they
have sudo, in which case, they shouldn't have sudo or the root password.

However, if shutdown is for some reason executable by anyone, you could just
chmod go-x it and make sure its owned by root (it should be), making it
executable only by root. At that point, any non-root or non-sudo user typing
!sh will just get "permission denied" when they try to run it.

You could also remote /sbin from everyones PATH by taking it out of
/etc/profile.

Good luck!

Chet

On Fri, May 23, 2008 at 7:27 PM, Paul Dwerryhouse <paul@xxxxxxxxxxxxxxxxxx>
wrote:

On Fri, May 23, 2008 at 01:53:20PM -0400, Billy Davis wrote:
It seems that some of our users are inclined to key in '!sh' at the
shell prompt, which promptly shuts down our Red Hat Enterprise 3 Server,
interrupting everyone else's work. Is there a line that we can add to
the inittab file, that will trap this string, in the same fashion that
the 'ca::ctrlaltdel:/sbin/shutdown -t3 -r now' line traps
Ctrl-Alt-Delete inputs?

Dodgy answer: move /sbin/shutdown to a location that isn't in the path,
so that typing just 'shutdown' from a command line without the full path
to it will result in 'command not found'.

Better answer: take root access away from users who aren't sensible
enough to know how to use it properly. If they *have* to have root
access for some reason (and I really can't think of any reason why they
should have it), force them to use sudo with a restricted range of
commands that they need.

Cheers,

Paul

--
Paul Dwerryhouse | PGP Key ID: 0x6B91B584
========================================================================

http://linoleum.leapster.org/ - Linux Programming Resources

--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list




--
/*
Chet Nichols III
mail: chet.nichols@xxxxxxxxx
(aim: chet / twitter: chet)
*/
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list

Relevant Pages

  • Re: smbmount w2k3 no write access
    ... Use sudo. ... commands that you need to execute as root in it, ... USERS ALL = NOPASSWD: SHUTDOWN, NTPDATE ...
    (Debian-User)
  • Re: FreeBSD 7.2 RC1 amd64 Installation
    ... Mehmet Erol Sanliturk wrote: ... there is no a Shutdown item. ... It is necessary for the root open a terminal console, ... Have you installed sudo? ...
    (freebsd-stable)
  • Re: GUI login screen.
    ... >>There are a few things I dont understand about Debians login screen. ... Root cannot log in on this screen. ... Well I cant figure out how to shutdown other than login as ... > As a normal user, you don't have permission to shut down. ...
    (Debian-User)
  • Re: [opensuse] Cannot shut down
    ... Shutdown using K menu and hangs, pressed Ctrl-Alt-Backspace, root ... Shutting down by pressing the power button directly always crashed ... If SuSE live doesn't work still, but Zenwalk ...
    (SuSE)
  • "shutdown now" on F11 as root problems and app crashes in VNC sessions
    ... I've normally used the command "shutdown now" as root in a terminal window, in a remote VNC session, on other machines and it works. ...
    (Fedora)