[gentoo-server] su program and its limitations.

[Miguel Sousa Filipe]

Hello all,

The su program in gentoo, that comes with  sys-apps/shadow is in my view 
very limited.

In a Suse system, I had several system users with /bin/false has a 
shell, since all they did was use the email, and ftp for site updates.
Now that this instalation was migrated to gentoo, I am unable to do 
things like: su username -c "start aplication", simply because this 
version of su  passes it has an argument to the login shell.
And there is no way to override the defined shell.

Basically, and in short words, this sucks!
I had users that were used to execute tomcat, or a sybase database, and 
now they are obliged to have a shell. There is no need for those users 
to have a shell.

More problematic it is with users with mail acounts, that only use the 
system for mail, but there is sometimes the need to su username -c 
/bin/bash to do or to check certain things.
The reason their shell was /bin/false is because these users are simple 
office workers who might leave their password in a postit or in a 
drawer. It is a good idea to limit their shell access to the 
email/web/database server.
(there isn't the need for a big  security or containment policy enforcing)


The Suse version of su comes with:
# rpm -qf /bin/su
sh-utils-2.0-106
and supports the -s argument for passing a valid shell. (and the man 
page is very nice)
Our (gentoo) su, doesn't support the -s argument.


Is there a way that we have a more flexible, or less limited 'su' by 
default?

Congrats to the gentoo developers, gentoo is "emerging" in the 
enterprise world..

-- 

 Miguel Figueiredo Mascarenhas de Sousa Filipe
 email: miguel@×××××××××××.pt (PORTUGAL)
 http://mega.ist.utl.pt/~miguel

 Equipa de Administração de Sistemas
 Rede das Novas Licenciaturas (RNL)
 Instituto Superior Técnico
 http://www.rnl.ist.utl.pt
 http://mega.ist.utl.pt