0

Let's assume I have created a system user account in order to run services without being root. These services access some folders with many files inside, and the system account owns this folder/files. Since I have to execute some commands that will updates the content of this folder, I have to use root since the system account cannot login...but doing that, the updated/new files will be owned by root now. And the service, running as the system user, could be stop working when it will try to access that folders/files.

So what is the best solution? I have to reset permissions every time just after running the commands as root? or its better to give login and sudo powers to that account? or there is a way to run the commands as root without changing the existing permissions?

Hope my question is clear.

thanks

  • You should be able to "login" as "system user account" with su or sudo if you are logged in as root. Or even delete and recreate it with the same user name and ID if there's really a problem. – Tom Yan Oct 25 '19 at 10:44
  • Also AFAIK, making changes to a file doesn't as root doesn't necessarily change the ownership of it (although some program might do weird things when you are root). – Tom Yan Oct 25 '19 at 10:45
  • its better to give login and sudo powers to that account makes me think that you are not asking the real question... – Tom Yan Oct 25 '19 at 10:46
  • if I create an user with useradd -r user--shell /bin/false I can't login. But this is the right way to create user for running daemons and services as I know – SUPERALEX Oct 25 '19 at 11:05
0

If you really just want run a shell with another user that you cannot login as usual, it can be easily done with sudo or even su:

[tom@archlinux ~]$ sudo useradd -r test -s /bin/false
[tom@archlinux ~]$ sudo -u test -s
[test@archlinux tom]$ exit
[tom@archlinux ~]$ 
[tom@archlinux ~]$ su -c "useradd -r test -s /bin/false"
Password: 
[tom@archlinux ~]$ su
Password: 
[root@archlinux tom]# exec su test -s /bin/bash
[test@archlinux tom]$ exit
[tom@archlinux ~]$ 
| improve this answer | |
  • I didn't know I could login to system user without shell set. I tried "su test" but didn't work...I will use "sudo -u test -s" to login to the nodejs user – SUPERALEX Oct 25 '19 at 16:00
0

If you update a file, that is unlikely to be modifying the ownership. However, if you are logged in as root, you may have an issue with the idea that new files are owned by root.

One option is to chown (change ownership) of the files after they are created. This may create a "race condition" which, even if the risk is small, there is sound theory in just not creating an unlikely problem if possible.

Another option might be to upload the desired new files as an archive file as root, and then chown that file, and then extract the file as an end user.

It sounds like it may be a good idea to strongly consider just logging in as the account you want the files to be owned by. Then you have no race conditions. I realize the general desired practice of not wanting to have a service account be logged in. But what you're seeking to do is to take that general advice to an extreme level by inventing a workaround, by logging in as a different user (root) instead. And then you're coming up with some concerns about the logical impacts of the approach taken. Utilizing a not-straight-forward workaround may be more prone to causing problems, and thereby be riskier than having an account be able to log in.

As a general principle, don't take some generally-good advice to such an extreme that you inflexibly apply the suggestion in absolutely every scenario, including situations where that advice would create unnecessary significant problems.

Keep in mind that you may be able to log into this account, and then use sudo but still be restrictive. sudo can be set up to only allow specific commands (or commands that start with some specific text). I've sometimes created an account that can log in using only a specific SSH key, and which can then sudo and only run the specific command provided. Then control to run that command can be given to anyone who has that safely-guarded SSH key.

It also sounds like you might benefit from relying on "group owner" permissions (often just called "group permissions"). You may also benefit from utilizing another account, e.g. "service-account" and "account-used-for-updates" (in addition to, or instead of, using the widely known-to-be-potentially-dangerous "root" account).

| improve this answer | |
  • I have cloned a git repository with a nodejs project into a folder and I run nodejs on that folder. I created a system account to run nodejs service. But if I need to pull the repository I have to do with root, and the updated files changes permissions...so the nodejs will have problems since is running with the system user not root... – SUPERALEX Oct 25 '19 at 11:09
  • But if I need to pull the repository I have to do with root why? And even if you do, why can't you just recursively chown the whole repo to make it owned by nodejs? – Tom Yan Oct 25 '19 at 13:06
0

It is common for service accounts not to have a password. This prevents them from being logged into but does not necessarily prevent access. Common access mechanisms include:

  • Having services started by a root process such as systemd or a startup script using "su" or one of its varients.
  • Using 'cron' to perform scheduled activities.
  • Adding a rule enable certain users to run commands as that user. This can be restricted to certain commands as the sudo documentation describes.
  • Using ssh with an authorized key to permit remote (or local) access. There are mechasisms to limit which commands can be run as well as which remote locations can connect.
  • The service may provide mechanisms for users to access its files.

If a service account is running an application, then that application should own any directories it will need to create or delete files in. It should also have appropriate access to any files it needs.

In your case I would change the user on your repository to the service account and run the pull request at that user. Or to be safer, create a second service account in the same group as the node.js runs as to own the files. Then use sudo to pull the files.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.