0

Is there a good was to start daemons as normal user?

I would like to place a little script on my homeserver to start und stop services like proftpd, mysql and samba. I tried it like this, but had no luck.

sudo -u root -S /etc/init.d/proftpd start < /home/name/password

2
  • 1
    See the great answers below, but note that you shouldn't be starting a bunch of daemons under the same user: The goal here is to minimize the access someone gets if they compromise a daemon, so Apache, MySQL, Samba, etc. should be getting their own service users.
    – voretaq7
    Feb 28, 2011 at 21:34
  • Which of these do you want to do? 1) Change the user and group id that the daemon is running as? 2) Provide a way for a user who normally would not have the permission to start the daemon to start it noninteractively? Your question title makes me think #1, but your question text makes me think #2.
    – sciurus
    Feb 28, 2011 at 21:39

3 Answers 3

3

I am assuming you are trying to give the www-data user the ability to start and stop certain daemons, but that you don't want to change the user that the daemons run as. You can do this easily with sudo. First, run visudo to safely edit /etc/sudoers. Now, define a command alias that lists all the init scripts for the daemons you want the www-data user to be able to control. The name of the alias is arbitrary. I don't know the exact names of the init scrips on debian. Overall, the line will looks something like

Cmnd_Alias WEBDAEMONS /etc/init.d/proftpd, /etc/init.d/mysql, /etc/init.d/samba

Next, authorize the www-data user to run those commands as root without a password on any server where this sudoers file is installed. That should look like

www-data ALL = (root) NOPASSWD: WEBDAEMONS

Finally, save the file and exit visudo. At this point, you should be able to log in as the www-data user and use sudo to run the commands you put in your command alias without needing to enter password. You could test this with something like the following:

billy@example:~$ sudo -i -u www-data bash
[sudo] password for billy:
www-data@example:~$ sudo /etc/init.d/proftpd restart
Restarting proftpd
www-data@example:~$ exit

3
  • Thank you, but it seems like proftpd then does not have the rights to create socket-files an so on. "notice: unable to bind to Unix domain socket at '/var/run/proftpd/test.sock': Permission denied"
    – Billy
    Feb 28, 2011 at 22:17
  • My bad! I didn't start it as root. Many thanks.
    – Billy
    Feb 28, 2011 at 22:29
  • Twmic You need an equals sign after Cmnd_Alias like Cmnd_Alias ALIAS_NAME = [path] Jun 22, 2017 at 14:49
2

Try something like:

start-stop-daemon --start --chuid www-data

Full details are in man start-stop-daemon(8).

start-stop-daemon man page

Note that in the case of ProFTPd, you should just be putting:

User www-data

In your proftpd.conf file.

ProFTPd User directive docs

For MySQL, put:

user = someusername

in /etc/mysql/my.cnf.

mysqld user option docs


For the password bit, I assume you're trying to enter your sudo password?

That's never a good way to do it.

One better way is to add lines like this to /etc/sudoers via visudo:

MYDAEMONS = /home/user/bin/startproftpd, /home/user/bin/startmysql  
youruser ALL = (root) NOPASSWD: MYDAEMONS

But I think we're still missing something. Why do you need this script? Is it just to change the user the daemon runs as?

1

If your daemon doesn't play nicely with start-stop-daemon, you can always use sudo -u www-data /path/to/command

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .