WARNING - Shell user must not be root or in group root.

Discussion in 'ISPConfig 3 Priority Support' started by Taleman, Mar 11, 2020.

  1. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Why does my ISPConfig server send me this:
    I got two emails, same contents and looks like same send time to the second.
    I created at about that time a new shell user, but I can not see how that user would be root or in group root. And checking from shell shows it is not. It is a jailed user, if that has something to do with this.
    One thing not usual with this is the website belonged to another user previously, I changed owner and created new database, dbuser, ftp user and shell user.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    The error message is a bit misleading as it was originally just a check for root, basically, it means username or groupname not allowed. The following checks are performed:

    Code:
    public function is_allowed_user($username, $check_id = true, $restrict_names = false) {
            global $app;
            
            $name_blacklist = array('root','ispconfig','vmail','getmail');
            if(in_array($username,$name_blacklist)) return false;
            
            if(preg_match('/^[a-zA-Z0-9\.\-_]{1,32}$/', $username) == false) return false;
            
            if($check_id && intval($this->getuid($username)) < $this->min_uid) return false;
            
            if($restrict_names == true && preg_match('/^web\d+$/', $username) == false) return false;
            
            return true;
        }
        
        public function is_allowed_group($groupname, $check_id = true, $restrict_names = false) {
            global $app;
            
            $name_blacklist = array('root','ispconfig','vmail','getmail');
            if(in_array($groupname,$name_blacklist)) return false;
            
            if(preg_match('/^[a-zA-Z0-9\.\-_]{1,32}$/', $groupname) == false) return false;
            
            if($check_id && intval($this->getgid($groupname)) < $this->min_gid) return false;
            
            if($restrict_names == true && preg_match('/^client\d+$/', $groupname) == false) return false;
            
            return true;
        }
    So the user or group is either in the blacklist, it does not match the requirements for the regex or it starts with the word web plus a number, which is reserved as well.
     
  3. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Error message would indeed be better with more specific message. And it shoud say which shell user was in error. I created only one shell user yesterday, so I assumed that was the culprit.
    But I still do not understand what was wrong with that user, if indeed that user was the problem.
     

Share This Page