2

I run a service on a debian/linux machine which runs at boot with a 'screen' session I can always attach to.

I would like to create a username which I can run this service as. At the moment I use a 'regular' login account. I would like the added security of a username dedicated to this sevrice (similar to the way 'nobody' or 'web' are used with apache).

Requirements:

  • No ability to login, locally or remotely (so no password to manage)
  • Ability for approved users to gain access to the screen session, and interact with the service.

I imagine the solution will have creative use of su/sudo and the details of how to create the account.

Improve this question

3 Answers 3

Reset to default
5

First, create the account the screen session runs as (say it's called screenimage), as well as a group of users allowed to use it (say screenusers):

adduser --system --group screenimage
addgroup --system screenusers

Then for each user allowed to use it, add them to the screenusers group:

adduser USER screenusers

Then, add approved users to /etc/sudoers: run visudo and add the line

%screenusers ALL = (screenimage) /usr/bin/screen

ETA: To address the other answers on this post: the --system creates accounts with no shell or password. The sudoers line means that the users are clamped to running screen, as the screenimage user only.

Improve this answer
4
  • 1
    +1 for actually using the tools the way they're intended.
    – Mykroft
    May 1, 2009 at 13:33
  • nice tip about --system, being doing stuff like this for so long that this didn't used to be there :)
    – Alnitak
    May 1, 2009 at 13:39
  • I presume the clamp to 'screen' is notional, if the daemon permits spawning of other processes?
    – John McAleely
    May 1, 2009 at 13:43
  • For completeness, what command should an approved user issue to gain access to the screen session?
    – John McAleely
    May 1, 2009 at 13:45
2

Creating the user is the easy part. Simply add a user with adduser script (this is debian specific but I noticed it's in your tags) then edit the resulting /etc/passwd line for that user. Change the x to a ! this makes it so that no password will ever match as valid. Change /bin/bash to /bin/falseso that if someone did log in as this user they would get no shell.

As for the rest it really depends on what service you're trying to run or how you need to interact with it. I feel like there's probably some better way to work that out than running it in a screen session.

Improve this answer
3
  • The service is a lisp image, which it is important to have interactive access to.
    – John McAleely
    May 1, 2009 at 13:29
  • ok, but make sure that there's no way for an interactive user of the lisp image to spawn further processes...
    – Alnitak
    May 1, 2009 at 13:33
  • I don't mind or care what the user can do inside the lisp image - I just don't want to manage a login password for this user.
    – John McAleely
    May 1, 2009 at 13:42
1

OK, how about (in /etc/rc.something):

sudo -u user screen -d -m service

and set user's shell to /bin/false.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .