Consul user is created with login shell

[madAndroid]

Hi,

We're implementing CIS compliance based on the CIS benchmark, and when we're running our InSpec profiles on servers that have consul installed via this module, the system user created for consul has a login shell set (/bin/bash in this case) .. would you be open to explicitly setting the shell to /sbin/nologin?

I'll send a PR if this is something that you're likely to accept a change for.

[solarkennedy]

Whoa. Yes please.

[solarkennedy]

Thank you for addressing this.

[madAndroid]

Thanks :)

[madAndroid]

It turns out this might be problematic :(

hashicorp/consul#1358 (comment)

We're now seeing health checks fail .. might be better to revert this change until the issue with consul using a login shell is fixed ... sorry for the hassle, turns out this wasn't a wise change

[solarkennedy]

Crap. Reverted :(

[madAndroid]

Sorry about that! a bit annoying that consul's using a login shell instead
of just running golang's exec... I've had to add an exception for our CIS
benchmarks for that, for now

On Tue, Nov 15, 2016 at 5:30 PM, Kyle Anderson notifications@github.com
wrote:

Crap. Reverted :(

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#293 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABQp3SXfHndRLqWfSMdedmh-c_U0wySZks5q-dAagaJpZM4KiBTg
.