How to (Extra) Ban Someone: Difference between revisions

From CSCWiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 1: Line 1:
Ahem, so in recent times, we had to *disable/ban* a CSC user's account for their repeated attempts to circumvent their ban in MathSoc/CSC (FR, totally no pun intended)...
Ahem, so in recent times, we had to ''disable/ban'' a CSC user's account for their repeated attempts to circumvent their ban in MathSoc/CSC (FR, totally no pun intended)...


This is a (hopefully comprehensive) guide on ensuring their existing account (based on their WATIAM) is put out of action for good, and immediately. This guide is mainly for *Syscom* as it requires root or admin access to many CSC services.
This is a (hopefully comprehensive) '''guide on ensuring their existing account (based on their WATIAM) is put out of action for good, and immediately'''. This guide is mainly intended for ''Syscom'' as it requires root or admin access to many CSC services.


=== Step 1: Remove Membership ===
=== Step 1: Remove Membership ===
Through CEO's TUI (`ceo`) or LDAP ([guide from Raymond](https://wiki.csclub.uwaterloo.ca/Ceo#raymo's_guide_on_how_to_fix_things_after_screwing_up)):
Through CEO's TUI (`ceo`) and LDAP ([[Ceo#raymo's guide on how to fix things after screwing up|guide from Raymond]]):


* Remove all their `memberTerm`
* '''<u>Remove All Membership Terms</u>''': look for `memberTerm` in `ldapvi`
* Reset their password (**and don't tell them!**)
* '''<u>Reset their password</u>''' (**and don't tell them!**)


=== Step 2: Screw Up Their Account ===
=== Step 2: Screw Up Their Account ===


* Change their Login Shell (through LDAP) to something like `/sbin/nologin` or `/bin/false`
* '''<u>Change their Login Shell</u>''' (through LDAP) to something like `/sbin/nologin` or `/bin/false`


'''NOTE''': CEO will not allow this change, so LDAP is best (and likely only way)
'''NOTE''': CEO will not allow this change, so LDAP is best (and likely only way)
Line 17: Line 17:
=== Step 3: Deauth Them Everywhere ===
=== Step 3: Deauth Them Everywhere ===


* '''<u>Suspend Kerberos</u>''': https://wiki.csclub.uwaterloo.ca/Kerberos#Suspending_an_Account - Remove their SSH keys:
* '''<u>Suspend Kerberos</u>''': https://wiki.csclub.uwaterloo.ca/Kerberos#Suspending_an_Account
* '''<u>Remove their SSH keys</u>''':
** Go to a Syscom-only machine that could edit the `/users` directory ('''be extremely careful''')
** Go to a Syscom-only machine that could edit the `/users` directory ('''be extremely careful''')
** Navigate to the banned users directory, and remove their ssh keys (`.ssh/authorized_keys`)
** Navigate to the banned users directory, and remove their ssh keys (`.ssh/authorized_keys`)

Revision as of 11:07, 18 September 2023

Ahem, so in recent times, we had to disable/ban a CSC user's account for their repeated attempts to circumvent their ban in MathSoc/CSC (FR, totally no pun intended)...

This is a (hopefully comprehensive) guide on ensuring their existing account (based on their WATIAM) is put out of action for good, and immediately. This guide is mainly intended for Syscom as it requires root or admin access to many CSC services.

Step 1: Remove Membership

Through CEO's TUI (`ceo`) and LDAP (guide from Raymond):

  • Remove All Membership Terms: look for `memberTerm` in `ldapvi`
  • Reset their password (**and don't tell them!**)

Step 2: Screw Up Their Account

  • Change their Login Shell (through LDAP) to something like `/sbin/nologin` or `/bin/false`

NOTE: CEO will not allow this change, so LDAP is best (and likely only way)

Step 3: Deauth Them Everywhere

Retrieved from "https://wiki.csclub.uwaterloo.ca/index.php?title=How_to_(Extra)_Ban_Someone&oldid=5066"