---
name: "login-sh"
section: "8"
platform: "linux"
package: "fwtk"
version: "1.3-1"
release: "Debian 1.3 (Bo)"
platforms: ["linux"]
url: "https://new.carta.tech/login-sh"
---

# login-sh(8)

authenticating login shell

## NAME

login-sh - authenticating login shell

## SYNOPSIS

**login-sh**

## DESCRIPTION

**login-sh** provides a simple interface to the authentication service for login by replacing the user's login shell with a "wrapper" that requires them to authenticate first, then executes the real login shell. **login-sh** may be used in conjunction with or as a replacement for passwords in the password file */etc/passwd.* The user's actual login shell information is stored in an external file.

Note that **login-sh** runs as the user, with their permissions. This is attractive, as it separates the authentication policy from the permissions granting policy (/bin/login).

## OPTIONS

**login-sh** reads its configuration rules and permissions information from the firewall configuration table **netperm-table,** retrieving all rules specified for "login-sh". The following configuration rules are recognized:

- **authserver address port**

  specifies the network address and service port of the authentication server to use. (See **authsrv)**

- **shellfile pathname**

  specifies a file that contains information about users' login shells. The shell configuration file. Empty lines and lines with a '#' as the first character are discarded or treated as comments. The format of the shell configuration file is a list of entries, one per line, in the form of:

  ```
  userid  executable parameter-0 [parameter-1] [parameter-n]
  ```

  The first three values must be defined. The *userid* field matches the login name of the user invoking **login-sh** from the **/etc/passwd** file. The second field should specify the executable pathname of the program to run after authentication is completed. The third and remaining fields are parameters to pass to the executable program, starting at parameter zero. Many command interpreters check the name of parameter zero *(argv\[0\])* to determine if they are a login shell. For such command interpreters, one should be careful to define them with the expected form, typically a leading dash '-'.

## INSTALLATION

To install **login-sh** first place the executable in a system area, and define the **shellfile** and **authserver** options in **netperm-table.** Systems that are using **login-sh** should have all programs that permit users to change their login shells disabled, or should have the setuid bit stripped.

Users password file entries should resemble:

```
mjr::100:10:Marcus J Ranum:/home/mjr:/usr/local/etc/login-sh
```

with a sample **shellfile** entry for *mjr* that resembles:

```
mjr	/usr/bin/ksh   -ksh
```

Note in the example, that the pathname (/usr/bin/ksh) and the first parameter for the program ("-ksh") are different. There must be a minimum of two parameters for each login shell that is defined.

Users wishing both password authentication and secondary authentication may set passwords on their entries in **/etc/passwd** as well as using **login-sh.**

## FILES

- **netperm-table**

  **shellfile** **/etc/passwd**

## SEE ALSO

[**netperm-table**(5)](/netperm-table/5.md) [**authsrv**(8)](/authsrv/8.md)

## BUGS

Some systems may require the administrator to add login-sh to **/etc/shells** as programs like **ftpd** check for a valid user shell before permitting access.