Illegal Login Shell

[Nobody's Hero]

I am getting nailed on a security audit for accounts with invalid shells.

example.

userid 11111 /bin/ksh
userid 22222 /bin/ksh

I thought that /bin/ksh is the standard login shell. Or is it because I need an entry in /etc/shells to reflect /bin/ksh as being valid?

[Peter Godron]

Robert,
see man ksh for more details, but I think the correct path is /usr/bin/ksh

[Robert-Jan Goossens]

Hi Robert,

I think you are correct, you could also change the korn-shell from /bin/ksh to /usr/bin/ksh.

Both shells are dynamically linked.

Regards,
Robert-Jan

[James R. Ferguson · Accepted solution]

Hi Robert:

Well, on HP-UX, the '/bin' directory is a symbolic link to '/usr/bin'.

In reality, '/bin' and '/lib' (which is a symbolic link to '/usr/bin'), among others are "transition" links dating to the time the filesystem layout was redrafted at the advent of HP-UX 10.0.

Transition links are *deprecated* and will (probably) *disappear* in 11iv3 (11.31).

The original white paper describing the filesystem changes appears here:

http://www.docs.hp.com/en/5963-8942/5963-8942.pdf

Transition links have a permission pattern that has a "t" as if the sticky bit were set:

# ls -ld /bin
lr-xr-xr-t 1 root sys 8 Aug 20 1997 /bin -> /usr/bin

This "t" indicates a transition link.

Regards!

...JRF...

[doug hosking]

Yes, /bin is a link to /usr/bin on some releases, but not all software is smart enough to know that, if it's just doing a string compare against the list of paths in /etc/shells, for example. I've found it less troublesome in some cases to include both the /bin version and the /usr/bin version of the shell path in /etc/shells for whatever list of shells you care about.