1

I use apache2-mpm-itk to run one of my web applications with a custom uid and gid, both for audit and security reasons. This works nicely, however I am not sure what kind of privileges this user would need. I am currently doing something like useradd mywebapp -U -d/tmp -c"Custom webapp User" but that creates pretty much a regular user.

So first a newbie question: how do I add a 'system' user that can that cannot be used for e.g. ssh'in or does not appear in the login screen on Ubuntu Desktop?

And what kind of privileges would I need to give this user? E.g. I assume that www-data can write to the Apache log files, so it needs something more than a regular user. But at the same time I don't want to give it more privileges than necessary to run my webapp, definitely not root.

1 Answer 1

3
sudo useradd username 

will work just fine for your requirement. It creates the user with unset/random password. If you insist on disabling shell access to the user you could change the shell option for this user to /bin/false with commands like

sudo chsh username

As for not showing username in GDM login screen, you need to give the username UID below 1000. This makes Ubuntu treat the user as a system user, which then won't show up on the login screen.

Add the user in whatever way you prefer(maybe just like above), and then run:

sudo usermod -u 599 username

Where 599 is an unused UID below 1000, and username is your new user.

6
  • Is there a smart way I can detect if a UID has been taken? All of this has to end up in an Ubuntu package. Feb 5, 2012 at 3:39
  • 1
    cat /etc/passwd | awk -F: '{print $3}' | sort -n
    – kaji
    Feb 5, 2012 at 3:41
  • What would be a smart way to find an unused uid between say 500 and 1000? Feb 5, 2012 at 3:56
  • there is no inbuilt commmand that i know of that will do the job. How about writing your own script for that !
    – kaji
    Feb 5, 2012 at 4:07
  • 1
    if you want to be able to make everybody able to view central access.log and error.log of apache, chmod o+r access.log and error.log
    – kaji
    Feb 6, 2012 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .