Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can we create a user account with no login shell for running the Tomcat server.

What is the purpose of User Account with no login shell ?

And How can no login shell user perform the installation of Tomcat Server using non-login user id ?

share|improve this question
    
The answer to this question seems related. –  ortang Nov 7 '13 at 13:28
add comment

2 Answers 2

  1. By creating a normal user account with a shell which either doesn't exist or doesn't allow user to run any commands. E.g. shell might be /bin/nologin or /bin/true.

  2. The idea is to give ownership of Tomcat files to a certain user instead of the super user, ie. 'root', so that when you run Tomcat you don't have to run that process as 'root'. For security, simply.

  3. Most likely this is not possible. What I'd do is to create a normal user account, do the installation and then change the login shell of the said account to be something else than a working shell (see 1).

share|improve this answer
add comment

To create a system user account with no shell:

$ sudo useradd -r -m -d ${TOMCAT_HOME} -s /sbin/nologin tomcat

By setting the shell to /sbin/nologin it is more difficult for the account to be accidentally comprimised (e.g., a password gets set for user tomcat and someone tries to login). It will also stop a shell from being created using sudo su tomcat -.

It is, however, still possible to run commands as this user with sudo:

$ sudo -u tomcat COMMAND

If using a package manager, be sure it doesn't already create a tomcat user for you. If extracting from an archive, ensure that the archive is in a location that is accessible by the tomcat user (e.g., /tmp).

share|improve this answer
    
I am not clear on the lines start from " By setting the shell.." Can you Explain in full details –  Java_Linux_Buddy_112358 Nov 7 '13 at 14:22
    
After the system allows a user to log in, a shell process is started. Typically a user shell is a program designed for interactive control (e.g., /bin/sh) but it can be any executable. The /sbin/nologin executable simply returns a message and exits, effectively logging the user session out. Setting /sbin/nologin is a backstop in the event other login control mechanisms (e.g., allowed uid range, no empty password, etc.) are not working properly. Even if the system allows the user to log in, the shell immediately exits. –  plasmid87 Nov 7 '13 at 15:02
    
@Java_Linux_Buddy_112358 you run chsh as the user in question to change the login shell. –  terdon Nov 7 '13 at 15:03
    
@terdon That's true, but you can only change the shell if the default login shell accepts commands - /sbin/nologin does not. –  plasmid87 Nov 7 '13 at 15:04
    
@plasmid87 ah OK, I just tried and it won't let me switch to /bin/false. I guess you have to edit /etc/passwd directly then. –  terdon Nov 7 '13 at 15:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.