Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to create a user account for each of the key programs installed on my debian server. For example, for the following programs:

Tomcat Nginx Supervisor PostgreSQL

This seems to be recommended based on my reading online. However, I want to restrict these user accounts as much as possible, so that they dont have a shell login, dont have access to the other programs and are as limited as possible but still functional.

Would anyone mind telling me how this could be achieved? My reading so far suggests this:

echo "/usr/sbin/nologin" >> /etc/shells useradd -s /usr/sbin/nologin tomcat

But I think there may be a more complete way of doing it.

EDIT: I'm using debian squeeze

share|improve this question
add comment

2 Answers 2

Which distro are you running? Good distros already set up their install scripts for such packages to create users specific to daemons that can benefit from running as a separate user. Some packages share a user where they need to cooperatively read/write on various files. But in all cases they tend to have nologin as their login shell, which is appropriate.

share|improve this answer
    
Debian Squeeze - Added to first post too. –  James Willson Sep 20 '12 at 15:28
add comment

I don't no whether it will help you or not just see this .

I want to restrict these user accounts as much as possible, so that they dont have a shell login

For this before creating user account just edit the /etc/default/useradd file

This

  1 # useradd defaults file
  2 GROUP=100
  3 HOME=/home
  4 INACTIVE=-1
  5 EXPIRE=
  6 SHELL=/bin/bash
  7 SKEL=/etc/skel
  8 CREATE_MAIL_SPOOL=yes

To This

  1 # useradd defaults file
  2 GROUP=100
  3 HOME=/home
  4 INACTIVE=-1
  5 EXPIRE=
  6 SHELL=/bin/nologin
  7 SKEL=/etc/skel
  8 CREATE_MAIL_SPOOL=yes

After changing this if you create a user account, for all those accounts it is not possible to login to system

That is because of this

user:x:1017:1017::/home/user:/bin/nologin -----> /etc/passwd file entry

see here

[max@localhost ~]$ su - user
Password: 
su: /bin/nologin: No such file or directory
[max@localhost ~]$ 

you can get this by editing /etc/passwd file directly no need to edit /etc/default/useradd

file if user's are less

just change last filed

This

user:x:1017:1017::/home/user:/bin/bash

To this

user:x:1017:1017::/home/user:/bin/nologin

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.