<story><title>/bin/false is not security (2005)</title><url>http://www.semicomplete.com/articles/ssh-security/</url></story><parent_chain></parent_chain><comment><author>bch</author><text>I recall reading of one Unix implementation that when executing &amp;#x2F;bin&amp;#x2F;false noticed that the spawned shell (&amp;#x2F;bin&amp;#x2F;false) had failed (because that’s what &amp;#x2F;bin&amp;#x2F;false does, by design) and helpfully launched &amp;#x2F;bin&amp;#x2F;sh so you could debug it. True or false (pun intended), this is why I use &amp;#x2F;bin&amp;#x2F;true to stand in as a shell in this capacity.</text></comment>
<story><title>/bin/false is not security (2005)</title><url>http://www.semicomplete.com/articles/ssh-security/</url></story><parent_chain></parent_chain><comment><author>STRML</author><text>FWIW, I tried that DoS idea on a little digitalocean machine. It capped the number of open file descriptors for the SSH daemon at 1024. Only about 3000 file descriptors were in use after it stopped allocating channels, and file-heavy operations like apt-get still succeeded.</text></comment>