NAME

       noshell — shell for administrative users that should never log in

DESCRIPTION

       noshell is a shell that can be assigned to system users which need to be active but should
       never log in to the system. noshell helps monitor attempts to access disabled accounts and
       logs this into syslog.

       If  a  user  attempts  to  connect to the system through an administrative user that has a
       valid password and uses noshell  as his shell, then the use of noshell will be logged, the
       connection will be terminated and the user will be unable to gain access to the host.

       After  connecting  the  login  program might display the timestamp of the last loging. For
       example, in a remote connection:

              hostileuser@hostile_host% ssh -l adminuser remote_host

              adminuser@remote_host's password: *******

              (System's /etc/motd)

              Last login: Sat Nov 22 23:30:41 2003 from localhost

              Connection to remote_host closed.

       If the user is denied access, noshell will send a message to  syslog  using  the  LOG_AUTH
       facility.  It  does not provide any indication of wether this connection attempt was local
       or remote, this information must be retrieved from other logs. In the  above  example  the
       following would get recorded in /var/log/authlog:

              Nov  22  23:30:41  remote_host  sshd[9950]:  Accepted  password  for adminuser from
              hostile_host port 44422 ssh2

              Nov 22 23:30:41 remote_host ssh(pam_unix)[9952]: session opened for user  adminuser
              by (uid=1)

              Nov  22  23:30:41  remote_host noshell[9953]: Noshell warning: user adminuser login
              from a disabled shell

              Nov 22 23:30:41 remote_host ssh(pam_unix)[9952]: session closed for user adminuser

       In Debian, noshell is an alternative to the nologin shell, the latter is provided  in  the
       login  package.  The  main  differences  between them is that noshell will not provide any
       information of why the access has been denied.

OPTIONS

       This program does not use any option.

SEE ALSO

       shells(5), login(1), nologin(8).

AUTHOR

       This manual page was written by Javier Fernandez-Sanguino Peña  <jfs@debian.org>  for  the
       Debian  system  (but  may  be  used by others).  Permission is granted to copy, distribute
       and/or modify this document under the terms of the GNU General Public License,  Version  2
       any later version published by the Free Software Foundation.

       On  Debian  systems,  the  complete text of the GNU General Public License can be found in
       /usr/share/common-licenses/GPL.

                                                                                    TITANTOOLS(1)