# su -m not allowed for /usr/sbin/nologin? [SOLVED]

## dfelicia

On other Linux distro's, this works for restricted users (user with /usr/sbin/nlogin shell):

```

su -m apache -c "echo test"

```

Where apache is the ID of a a restricted user.

Gentoo doesn't allow it.  How and why?  I'll assume the why is for security reasons, but how?  PAM?Last edited by dfelicia on Tue Oct 03, 2006 12:03 pm; edited 1 time in total

----------

## GetCool

Do you get any output, either at the console or in your logs?

----------

## dfelicia

Yes.

```

# su -m apache -c "echo test"

This account is currently not available.

```

----------

## GetCool

 *dfelicia wrote:*   

> 
> 
> ```
> 
> # su -m apache -c "echo test"
> ...

 

Well, I know this message appears when the account's shell isn't a valid shell.  According to the man page for su:

 *man su wrote:*   

> 
> 
> -m, -p, --preserve-environment
> 
> Preserve the current environment.
> ...

 

Edit: Although rereading your post it looks like you are running this command as root?

----------

## dfelicia

 *Quote:*   

> 
> 
> (unless su is called by root)
> 
> 

 

In my case su is called by root.  I expect that -m will cause su to NOT process the user's login shell, as on other Linux/UNIX.  On Gentoo, however, it does, as the /sbin/nologin output demonstrates.

So am I hitting a feature that I don't understand, or a bug?

----------

## GetCool

 *dfelicia wrote:*   

> So am I hitting a feature that I don't understand, or a bug?

 

It's probably a PAM thing.  Could it be this line in /etc/pam.d/login?

```
auth       required     pam_nologin.so
```

I don't really know much about PAM modules, so if you want to reconfigure PAM, I can't really be of any help.

----------

## dfelicia

I entered a bug for this behavior, and it was marked invalid with this explanation:

 *Quote:*   

> 
> 
> ------- Comment #1 from vapier@gentoo.org  2006-10-02 21:59 PST -------
> 
> -m has nothing to do with it
> ...

 

As advertised, -s does the trick:

```

su -s /bin/bash -m apache -c "echo foo"

foo

```

----------

