From 2442bd0a6d54cec6678f14a854c1db6e8617921b Mon Sep 17 00:00:00 2001
From: Niels Thykier <niels@thykier.net>
Date: Sun, 25 Jan 2015 09:45:37 +0100
Subject: [PATCH] en/issues: Document the base-password shell reset

Signed-off-by: Niels Thykier <niels@thykier.net>
---
 en/issues.dbk | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)

diff --git a/en/issues.dbk b/en/issues.dbk
index 4bcf3ad..08553ed 100644
--- a/en/issues.dbk
+++ b/en/issues.dbk
@@ -570,4 +570,91 @@ lxc.kmsg = 0
     the “settings” icon.
   </para>
 </section>
+
+<section id="base-passwd-hardening">
+  <!-- Wheezy to Jessie -->
+  <title>Changes to default shell of system users provided by
+  <systemitem role="package">base-passwd</systemitem></title>
+  <para>
+    The upgrade of <systemitem role="package">base-passwd</systemitem>
+    package will reset the shell of system users that is provides to
+    the "nologin" shell.  This includes the following users:
+  </para>
+  <itemizedlist>
+    <listitem>
+      <para>daemon</para>
+    </listitem>
+    <listitem>
+      <para>bin</para>
+    </listitem>
+    <listitem>
+      <para>sys</para>
+    </listitem>
+    <listitem>
+      <para>games</para>
+    </listitem>
+    <listitem>
+      <para>man</para>
+    </listitem>
+    <listitem>
+      <para>lp</para>
+    </listitem>
+    <listitem>
+      <para>mail</para>
+    </listitem>
+    <listitem>
+      <para>news</para>
+    </listitem>
+    <listitem>
+      <para>uucp</para>
+    </listitem>
+    <listitem>
+      <para>proxy</para>
+    </listitem>
+    <listitem>
+      <para>www-data</para>
+    </listitem>
+    <listitem>
+      <para>backup</para>
+    </listitem>
+    <listitem>
+      <para>list</para>
+    </listitem>
+    <listitem>
+      <para>irc</para>
+    </listitem>
+    <listitem>
+      <para>gnats</para>
+    </listitem>
+    <listitem>
+      <para>nobody</para>
+    </listitem>
+  </itemizedlist>
+  <para>
+    If your local setup requires that any of these users have a shell,
+    you should say no to migrating or migrate and then change the shell
+    of the necessary users.  Notable examples includes local backups
+    done via the "backup" user with an "ssh-key" authentication.
+  </para>
+  <caution>
+    <para>
+      The migration will happen automatically if your debconf question
+      priorty is "high" or above.
+    </para>
+  </caution>
+  <para>
+      If you know you want to keep the current shell of a given user,
+      you can preseed the questions by using the following:
+  </para>
+  <screen>
+    echo 'base-passwd base-passwd/system/<replaceable>username</replaceable>/shell/<replaceable>current-shell-mangled</replaceable>/_usr_sbin_nologin boolean false' | debconf-set-selections
+  </screen>
+  <para>
+    Where <replaceable>username</replaceable> is the name of the user
+    in question and <replaceable>current-shell-mangled</replaceable>
+    is the mangled name of the shell.  The mangling is done by
+    replacing all non-alphanumerical, non-dashes and non-underscores
+    with underscores.  E.g. /bin/bash becomes _bin_bash.
+  </para>
+</section>
 </chapter>
-- 
2.1.4