Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a custom daemon which manages a blacklist for my proxy (HAProxy). When the blacklist is updated I need to reload haproxy so that it has the most recent proxy. Unfortunately manually reloads of haproxy are not reasonable because the blacklist could be updated several times a day.

To solve this problem I created a script to reload haproxy but it needs to run as root so it can go through systemctl to be properly managed. This script is in the daemon user's bin directory. I have also changed the ownership of the file to another user (root for now) and permissions to -r-xr-x---. I plan to add the daemon user to the sudoers file with no password access to this script.

I want to know is this practice "secure" or is there a better alternative?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Yes, the correct way to set this up is to write a script which only does what the daemon needs, and create a specific sudoers entry to allow the daemon to execute the script. It's crucial that the daemon user can't modify the script though, so I wouldn't store it in the daemon's home directory. Rather put it somewhere like /usr/local/bin and make it only writeable by root.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.