Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to make sure that the user www-data cannot be used to login on my system (Ubuntu Lucid). How can I find out? - is there a command I can run against this user? (traditionally run by Apache daemon)

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

passwd -l www-data

share|improve this answer
1  
From man passwd: "Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account´s expire date to Jan 2, 1970)." –  Dennis Williamson Jul 12 '10 at 20:51
    
It's effectively disabled since he'd have to add a key to log in with it –  Daenyth Jul 13 '10 at 3:32
    
Hold on, when you talk about the account being 'disabled' - do you mean that Apache can no longer run as the user 'www-data'? (thats not what I want). I want Apache to continue running as the user www-data, but I dont want anyone to be able to log into the system using www-data as a username. I have seen attempts in my log of users trying a brute force attempt to hack into my server using the username www-data - that is what prompted this question. –  morpheous Jul 13 '10 at 14:46
1  
By disabled I mean to say that login is disabled. –  Daenyth Jul 13 '10 at 21:26
    
thanks for teh clarification ;) –  morpheous Jul 14 '10 at 9:58
add comment

The information you want is in the /etc/passwd file (which is world readable - the hashes of passwords are actually kept in /etc/shadow. So you can

$ grep www-data /etc/passwd

which should produce something along the lines of

www-data:x:111:112::/home/www-data:/bin/false

(I don't have apache installed, so the details are probably different). The important detail is the part after the last : which is the login shell. In this case it is /bin/false, which means you can't login as that user. If you look at the line corresponding to your username, you will see it is /bin/bash thus allowing you to login.

If www-data has a valid login shell then just go and edit /etc/passwd and change the login shell to /bin/false.

share|improve this answer
1  
And use vipw to edit the file so you don't mess it up! –  Daenyth Jul 12 '10 at 20:39
1  
Won't work if the authdb is in e.g. LDAP. –  Ignacio Vazquez-Abrams Jul 12 '10 at 21:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.