0

I want to have a user in Debian 7.x with the following restrictions:

  1. When the user logs in, a command-line program will automatically start in the user shell session. Then the program will parse the user input for ever and will execute commands until the user types a specific exit command.
  2. When the program terminates, the user must be automatically logged out.
  3. CTRL+C must either do nothing or abort the program and log out the user.
  4. To sum up, the user must not be allowed to interact with the system in any way other than this automatically started program. This should hold true, regardless of the way the session is started, whether SSH or other means.

As a starting point, I have added this lines at the end of the new user's .bashrc (user's shell is bash):

exec /path/to/myprogram
logout

Generally, it works. However, if the start of session is slow, a (not particularly fast) user could hit CTRL-C and be happily prompted on the terminal before myprogram starts. How can I avoid this?

Assigning a fake shell such as /usr/sbin/nologin or /bin/false to the user will not work, as it would not allow to start the program either.

4
  • Can you set the program as a shell? (e.g. allow it in /etc/shellls and chsh to it for that user?)
    – Hennes
    Dec 14, 2015 at 14:17
  • Yes, I have done that and it works! I think that this is exactly what I wanted. As a summary, I have done this: 1) Add my program in /etc/shells. 2) Set my program as user's shell in /etc/passwd. Thank you very much! Dec 14, 2015 at 14:50
  • Let me write a slightly longer answer :)
    – Hennes
    Dec 14, 2015 at 14:56
  • Yes, of course. Great! Dec 14, 2015 at 15:13

1 Answer 1

1

Normal users log authenticate (aka user/pass) and are then presented by a shell. The system looks up which shell to start in their password file.

A user can change her or his shell with the change shell (chsh) command, though this might be limited to a list of shells listed in /etc/shells.

In this case we do not want to start an interactive shell. Rather than starting bash and then asking bash to overwrite itself with another program, we immediately start the other program.

The result is that:

  1. The program gets started. No shell is in between and there is no shell to catch a quick control-C
  2. When the program terminates the same thing happens as when the shell termintes (e.g. after exit or controld). The user is logged out.

Note that this assumes that the user cannot break out of the program. Which is not always true. (e.g. a mailreader sunch as elm can escape to a shell. Same for vim). Barring these cases the user will have no choice between logging in and using the one single assigned program.

PS: That also means no access to passwd. I hope the password never expires.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .