<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Century Gothic";
panose-1:2 11 5 2 2 2 2 2 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Century Gothic \, sans-serif";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Century Gothic","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">That is probably what I will end up doing, thanks for all the input so far.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Marc Boorshtein [mailto:marc.boorshtein@tremolosecurity.com]
<br>
<b>Sent:</b> Friday, December 11, 2015 9:49 AM<br>
<b>To:</b> Redmond, Stacy<br>
<b>Cc:</b> freeipa-users; Nicola Canepa<br>
<b>Subject:</b> Re: [Freeipa-users] Service Accounts via IPA<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">** BSCA security warning: Do not click links or trust the content unless you expected this email and trust the sender – This email originated outside of Blue Shield. **<o:p></o:p></p>
</div>
<p>I do the same thing on most deployments. I usually just assign a large random password to the service account.
<o:p></o:p></p>
<p>Marc Boorshtein<br>
CTO, Tremolo Security, Inc.<o:p></o:p></p>
<div>
<p class="MsoNormal">On Dec 11, 2015 12:15 PM, "Redmond, Stacy" <<a href="mailto:stacy.redmond@blueshieldca.com">stacy.redmond@blueshieldca.com</a>> wrote:<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">No, that does not even allow su – unless you add the –s /bin/bash or some valid shell. I
did try a few of these, generally I just put a ! I front of the password locally, but since these exist in ldap now instead, not sure that is an option.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Nicola Canepa [mailto:<a href="mailto:canepa.n@mmfg.it" target="_blank">canepa.n@mmfg.it</a>]
<br>
<b>Sent:</b> Thursday, December 10, 2015 11:55 PM<br>
<b>To:</b> Redmond, Stacy; <a href="mailto:freeipa-users@redhat.com" target="_blank">
freeipa-users@redhat.com</a><br>
<b>Subject:</b> Re: [Freeipa-users] Service Accounts via IPA</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">** BSCA security warning: Do not click links or trust the content unless you expected this email and trust the sender – This email originated outside of Blue Shield. **<o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">Maybe you can use /usr/sbin/nologin as the shell?<br>
<br>
Nicola<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Il 10/12/15 19:24, Redmond, Stacy ha scritto:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Century Gothic , sans-serif","serif"">Generally I will lock a service account on linux so that the account cannot login, but users can
sudo su – to that user. As I don’t have access to the password field in free ipa, what are my options to set this up as a default for service accounts, or how can I modify individual accounts that need access to a system, but should not be able to login to
the system. Any help is appreciated.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><o:p> </o:p></p>
</blockquote>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><o:p> </o:p></p>
<pre>-- <o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>Nicola Canepa<o:p></o:p></pre>
<pre>Tel: <a href="tel:%2B39-0522-399-3474" target="_blank">+39-0522-399-3474</a><o:p></o:p></pre>
<pre><a href="mailto:canepa.n@mmfg.it" target="_blank">canepa.n@mmfg.it</a><o:p></o:p></pre>
<pre>---<o:p></o:p></pre>
<pre>Il contenuto della presente comunicazione è riservato e destinato esclusivamente ai destinatari indicati. Nel caso in cui sia ricevuto da persona diversa dal destinatario sono proibite la diffusione, la distribuzione e la copia. Nel caso riceveste la presente per errore, Vi preghiamo di informarci e di distruggerlo e/o cancellarlo dal Vostro computer, senza utilizzare i dati contenuti. La presente comunicazione (comprensiva dei documenti allegati) non avrà valore di proposta contrattuale e/o accettazione di proposte provenienti dal destinatario, nè rinuncia o riconoscimento di diritti, debiti e/o crediti, nè sarà impegnativa, qualora non sia sottoscritto successivo accordo da chi può validamente obbligarci. Non deriverà alcuna responsabilità precontrattuale a ns. carico, se la presente non sia seguita da contratto sottoscritto dalle parti.<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>The content of the above communication is strictly confidential and reserved solely for the referred addressees. In the event of receipt by persons different from the addressee, copying, alteration and distribution are forbidden. If received by mistake we ask you to inform us and to destroy and/or delete from your computer without using the data herein contained. The present message (eventual annexes inclusive) shall not be considered a contractual proposal and/or acceptance of offer from the addressee, nor waiver recognizance of rights, debts and/or credits, nor shall it be binding when not executed as a subsequent agreement by persons who could lawfully represent us. No pre-contractual liability shall apply to us when the present communication is not followed by any binding agreement between the parties.<o:p></o:p></pre>
</div>
</div>
<p class="MsoNormal"><br>
--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.redhat.com_mailman_listinfo_freeipa-2Dusers&d=AwMFaQ&c=hNAZrKxPkhfPADjr9wUJ4AJ2gCqdYYgx1uIsXrLIsh-DuhNfnmQL7Uyhk3cxPIdo&r=JsDTB76-3eZrht7R5YNlXe7iBejsWCoV1YpaDE3cXO0&m=n7S68QYI493Q55zNcp4O8sTxaKCRzzW6UvySGVOt9xI&s=gB8Mv6dcgtXa0UGgh5veuvYnutUvRuKMINZ9cqzJjnM&e=" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__freeipa.org&d=AwMFaQ&c=hNAZrKxPkhfPADjr9wUJ4AJ2gCqdYYgx1uIsXrLIsh-DuhNfnmQL7Uyhk3cxPIdo&r=JsDTB76-3eZrht7R5YNlXe7iBejsWCoV1YpaDE3cXO0&m=n7S68QYI493Q55zNcp4O8sTxaKCRzzW6UvySGVOt9xI&s=Y-N5X1PXaMcc-dQJmTK3p8mjBcr8mFpUbUch1VhGSmA&e=" target="_blank">
http://freeipa.org</a> for more info on the project<o:p></o:p></p>
</div>
</div>
</body>
</html>