Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a good was to start daemons as normal user?

I would like to place a little script on my homeserver to start und stop services like proftpd, mysql and samba. I tried it like this, but had no luck.

sudo -u root -S /etc/init.d/proftpd start < /home/name/password

share|improve this question
1  
See the great answers below, but note that you shouldn't be starting a bunch of daemons under the same user: The goal here is to minimize the access someone gets if they compromise a daemon, so Apache, MySQL, Samba, etc. should be getting their own service users. –  voretaq7 Feb 28 '11 at 21:34
    
Which of these do you want to do? 1) Change the user and group id that the daemon is running as? 2) Provide a way for a user who normally would not have the permission to start the daemon to start it noninteractively? Your question title makes me think #1, but your question text makes me think #2. –  sciurus Feb 28 '11 at 21:39

3 Answers 3

up vote 1 down vote accepted

I am assuming you are trying to give the www-data user the ability to start and stop certain daemons, but that you don't want to change the user that the daemons run as. You can do this easily with sudo. First, run visudo to safely edit /etc/sudoers. Now, define a command alias that lists all the init scripts for the daemons you want the www-data user to be able to control. The name of the alias is arbitrary. I don't know the exact names of the init scrips on debian. Overall, the line will looks something like

Cmnd_Alias WEBDAEMONS /etc/init.d/proftpd, /etc/init.d/mysql, /etc/init.d/samba

Next, authorize the www-data user to run those commands as root without a password on any server where this sudoers file is installed. That should look like

www-data ALL = (root) NOPASSWD: WEBDAEMONS

Finally, save the file and exit visudo. At this point, you should be able to log in as the www-data user and use sudo to run the commands you put in your command alias without needing to enter password. You could test this with something like the following:

billy@example:~$ sudo -i -u www-data bash
[sudo] password for billy:
www-data@example:~$ sudo /etc/init.d/proftpd restart
Restarting proftpd
www-data@example:~$ exit

share|improve this answer
    
Thank you, but it seems like proftpd then does not have the rights to create socket-files an so on. "notice: unable to bind to Unix domain socket at '/var/run/proftpd/test.sock': Permission denied" –  Billy Feb 28 '11 at 22:17
    
My bad! I didn't start it as root. Many thanks. –  Billy Feb 28 '11 at 22:29

If your daemon doesn't play nicely with start-stop-daemon, you can always use sudo -u www-data /path/to/command

share|improve this answer

Try something like:

start-stop-daemon --start --chuid www-data

Full details are in man start-stop-daemon(8).

start-stop-daemon man page

Note that in the case of ProFTPd, you should just be putting:

User www-data

In your proftpd.conf file.

ProFTPd User directive docs

For MySQL, put:

user = someusername

in /etc/mysql/my.cnf.

mysqld user option docs


For the password bit, I assume you're trying to enter your sudo password?

That's never a good way to do it.

One better way is to add lines like this to /etc/sudoers via visudo:

MYDAEMONS = /home/user/bin/startproftpd, /home/user/bin/startmysql  
youruser ALL = (root) NOPASSWD: MYDAEMONS

But I think we're still missing something. Why do you need this script? Is it just to change the user the daemon runs as?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.