Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I run a service on a debian/linux machine which runs at boot with a 'screen' session I can always attach to.

I would like to create a username which I can run this service as. At the moment I use a 'regular' login account. I would like the added security of a username dedicated to this sevrice (similar to the way 'nobody' or 'web' are used with apache).

Requirements: - No ability to login, locally or remotely (so no password to manage) - Ability for approved users to gain access to the screen session, and interact with the service.

I imagine the solution will have creative use of su/sudo and the details of how to create the account.

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

First, create the account the screen session runs as (say it's called screenimage), as well as a group of users allowed to use it (say screenusers):

adduser --system --group screenimage
addgroup --system screenusers

Then for each user allowed to use it, add them to the screenusers group:

adduser USER screenusers

Then, add approved users to /etc/sudoers: run visudo and add the line

%screenusers ALL = (screenimage) /usr/bin/screen

ETA: To address the other answers on this post: the --system creates accounts with no shell or password. The sudoers line means that the users are clamped to running screen, as the screenimage user only.

share|improve this answer
1  
+1 for actually using the tools the way they're intended. –  Mykroft May 1 '09 at 13:33
    
nice tip about --system, being doing stuff like this for so long that this didn't used to be there :) –  Alnitak May 1 '09 at 13:39
    
I presume the clamp to 'screen' is notional, if the daemon permits spawning of other processes? –  John McAleely May 1 '09 at 13:43
    
For completeness, what command should an approved user issue to gain access to the screen session? –  John McAleely May 1 '09 at 13:45
add comment

Creating the user is the easy part. Simply add a user with adduser script (this is debian specific but I noticed it's in your tags) then edit the resulting /etc/passwd line for that user. Change the x to a ! this makes it so that no password will ever match as valid. Change /bin/bash to /bin/falseso that if someone did log in as this user they would get no shell.

As for the rest it really depends on what service you're trying to run or how you need to interact with it. I feel like there's probably some better way to work that out than running it in a screen session.

share|improve this answer
    
The service is a lisp image, which it is important to have interactive access to. –  John McAleely May 1 '09 at 13:29
    
ok, but make sure that there's no way for an interactive user of the lisp image to spawn further processes... –  Alnitak May 1 '09 at 13:33
    
I don't mind or care what the user can do inside the lisp image - I just don't want to manage a login password for this user. –  John McAleely May 1 '09 at 13:42
add comment

OK, how about (in /etc/rc.something):

sudo -u user screen -d -m service

and set user's shell to /bin/false.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.