up vote 1 down vote favorite
1
share [g+] share [fb]

I want to make sure that the user www-data cannot be used to login on my system (Ubuntu Lucid). How can I find out? - is there a command I can run against this user? (traditionally run by Apache daemon)

link|improve this question
70% accept rate
feedback

3 Answers

up vote 1 down vote accepted

passwd -l www-data

link|improve this answer
1  
From man passwd: "Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account´s expire date to Jan 2, 1970)." – Dennis Williamson Jul 12 '10 at 20:51
It's effectively disabled since he'd have to add a key to log in with it – Daenyth Jul 13 '10 at 3:32
Hold on, when you talk about the account being 'disabled' - do you mean that Apache can no longer run as the user 'www-data'? (thats not what I want). I want Apache to continue running as the user www-data, but I dont want anyone to be able to log into the system using www-data as a username. I have seen attempts in my log of users trying a brute force attempt to hack into my server using the username www-data - that is what prompted this question. – morpheous Jul 13 '10 at 14:46
1  
By disabled I mean to say that login is disabled. – Daenyth Jul 13 '10 at 21:26
thanks for teh clarification ;) – morpheous Jul 14 '10 at 9:58
feedback
up vote 2 down vote

The information you want is in the /etc/passwd file (which is world readable - the hashes of passwords are actually kept in /etc/shadow. So you can

$ grep www-data /etc/passwd

which should produce something along the lines of

www-data:x:111:112::/home/www-data:/bin/false

(I don't have apache installed, so the details are probably different). The important detail is the part after the last : which is the login shell. In this case it is /bin/false, which means you can't login as that user. If you look at the line corresponding to your username, you will see it is /bin/bash thus allowing you to login.

If www-data has a valid login shell then just go and edit /etc/passwd and change the login shell to /bin/false.

link|improve this answer
1  
And use vipw to edit the file so you don't mess it up! – Daenyth Jul 12 '10 at 20:39
1  
Won't work if the authdb is in e.g. LDAP. – Ignacio Vazquez-Abrams Jul 12 '10 at 21:09
feedback
up vote -1 down vote

As root:

su - www-data
link|improve this answer
1  
This will still login on an expired account. – Dennis Williamson Jul 12 '10 at 20:56
also, you can remove the password for root, and disallow root to login via SSH, but still do a sudo su - from an authorized user, which shows that you can login as "root", just not directly (or any other user) – warren Sep 28 '10 at 15:06
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.