RE: Security options :-(

[Douglas Finkle]

> > > That is, cvsphil can't login from the console, from telnet,
> > > rlogin, etc.  I think this is mainly done by setting his 
> login shell to
> > > "/sbin/nologin" or the equivalent.
> >
> > You'll also need to configure cvsphil such that he can only 
> log on with 
> > a particular keypair. Otherwise, what stops phil from using the su 
> > command to sidestep this elaborate configuration?
> 
> [/home/mzieg] mzieg $ grep cvsmark /etc/passwd
> cvsmark:x:510:510:CVS-only account for Mark 
> Zieg:/home/cvsmark:/sbin/nologin
> 
> [/home/mzieg] mzieg $ su cvsmark
> Password:
> This account is currently not available.
> 
> [/home/mzieg] mzieg $ su cvsmark -c "ls /usr/local/cvsroot"
> Password:
> This account is currently not available.

AFAIK, ssh requires a real shell-- but you can disable passwd
auth at the os and application layer.  This is my recollection
of how it worked on solaris. I am presently doing this along w/
restricting the ssh key usage to a single command-- only difference
is I allow *no* logins on the cvs server at all, except at the
admin level.