chsh tips — authorized shell-change literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run chsh on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any write — never change production shells without change control.
3. Record short factual notes; quote short Evidence (login, old shell, new shell — never passwords).
4. Optional: usermod -s → usermod-tips (related lever).
5. Optional: GECOS → chfn-tips; non-login → nologin-tips.
6. Prefer shells listed in /etc/shells on the authorized host — quote the path you chose.
7. Prefer disposable lab accounts for shell drills.
8. Stop at literacy — no attack or unauthorized shell-plant cookbooks.

Allowed framing

• Classroom labs reviewing chsh -s /bin/bash (or syllabus shell) on authorized disposable accounts.
• Binding short factual notes as Evidence (shell path intent + resulting getent — no secrets).
• Documenting expected vs observed shell for authorized inventory notes.
• Comparing chsh ↔ usermod -s / chfn / nologin peer tip pages under one binder.
• Testing invalid-shell refusals when the syllabus authorizes that drill.

Scope we will not cover

• No crack/pirate/keygen via chsh.
• No intentional unauthorized shell plants against foreign hosts.
• No secret-theft or backdoor-shell cookbooks against hosts you do not own.
• No cookbooks that point production accounts at untrusted binaries without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with util-linux / chsh installed.
2. Create a throwaway account via useradd-tips before any chsh drill.
3. With authorization, change the lab shell to a path listed in /etc/shells; quote getent passwd afterward as Evidence.
4. Optional: GECOS with chfn-tips; non-login drills with nologin-tips.
5. Stop at literacy — no attack or unauthorized shell-change cookbooks.

Practical notes for authorized labs

• Prefer shells from /etc/shells; quote refusals when an invalid path is rejected.
• usermod -s is a related admin lever — keep Evidence labels distinct from interactive chsh.
• Pair with nologin-tips when the syllabus wants a non-interactive shell.
• Never commit before/after passwd dumps to git — even for labs.
• Label lab-only shell changes clearly so they are not mistaken for production posture.
• If chsh prompts for a password, treat that as local auth — never paste the password into notes.

FAQ-aligned refusals (quick)

• Foreign-host shell changes → refuse.
• Backdoor-shell plant cookbooks → refuse.
• Attack/privilege-escalation framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources