Lighttpd enables a login shell for user www-data

[Sölvi Páll Ásgeirsson]

Binary package hint: lighttpd

I'm using Ubuntu 7.10/amd64, this report regards lighttpd 1.4.18-1ubuntu1.3.
The package creates the user www-data, which lighttpd is run as.
However, the www-data user, by default, has the login shell /bin/sh.
I can see no reason why this user has a valid login shell, instead of /bin/false.

[Stephan Rügamer (sruegamer)]

this bug against lighty is invalid, because the bugger actually is base-passwd.

Colin, any reasoning why we have to create those accounts with /bin/sh and not /bin/false or whatever is reasonable to not have an open shell by accident?

regards,

\sh

[Colin Watson (cjwatson)]

This is well-known, but I want to be extremely careful not to break anything, and base-passwd has to be converted to debconf prompting before this can be changed, otherwise it will cause terminal prompts for everyone. Please do not change this in an Ubuntu-specific upload.

[Colin Watson (cjwatson)]

The specific possibility for breakage that comes to mind is maintainer scripts that drop privileges from root to the users in question using su(1). That breaks if the shell is changed to /bin/false.

[Launchpad Janitor (janitor)]

This bug was fixed in the package base-passwd - 3.5.30

---------------
base-passwd (3.5.30) unstable; urgency=medium

  [ Colin Watson ]
  * Remove config.h.in and configure, now autogenerated by dh-autoreconf.
  * Change the shell of all global static users other than root (which
    retains /bin/sh) and sync (as /bin/sync is rather harmless) to
    /usr/sbin/nologin (closes: #274229; LP: #216813, #248844).
  * Policy version 3.9.5.

  [ Russ Allbery ]
  * Add support for debconf prompting to update-passwd (closes: #184979).

 -- Colin Watson <email address hidden> Tue, 07 Jan 2014 15:41:06 +0000