Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've manually installed a service called Gate One into /opt. I want to harden its security, so I thought I'd create a system account for it to use, because of least necessary privileges, and all that.

However, when I ran adduser --system gateone, it created a home directory, which I didn't really want. Therefore, I ran adduser --system --home-dir /opt/gateone gateone, because I'd seen some system accounts setting home directories pertaining to them. However, this made the login shell /bin/sh instead of /bin/false, which it had done the first time (when I didn't specify a home directory). I'm a bit confused now on what I should set these fields as.

tl;dr: when creating a system account on a *NIX operating system, what are the best practices for setting the home directory, the login shell, and anything else that's relevant? Why?

Note: I'm using Ubuntu 13.04 Raring, if it matters, since IIRC adduser can vary quite a bit distribution-to-distribution.

share|improve this question
7  
1) Don't use frontends to useradd if you don't want them making decisions for you. 2) Explicitly set any account details that you don't want defaults being assumed for. –  Andrew B Jun 22 '13 at 15:14
    
I have the thing running as "nobody" with group "nogroup". –  offby1 Jul 10 '13 at 17:50

2 Answers 2

up vote 9 down vote accepted

There isn't really a specific best practice, except that the shell should be /bin/false unless a shell is needed, the password hash should be ! unless the user is expected to log in, a descriptive name should be given, and a home directory should be set to /dev/null or similar if the application doesn't require a valid home directory. The user should have its own group, preferably in the system ID range; if it doesn't require a primary GID of root, for instance, don't give it one, and certainly don't give it users without a specific requirement. It all depends. Specify everything you care about (see man adduser for all the available options).

share|improve this answer
3  
That covers most of my hit list. As a general rule it should also have a dedicated group (e.g. if the user is bind there should be a group bind with a matching ID), and the UID/GID should be within your OS's "system UID range" (typically < 1000). –  voretaq7 Jun 23 '13 at 3:38
    
Good catch. I'll edit. –  Falcon Momot Jun 23 '13 at 3:41

If you try to install application the best choice is to make a package for that system and follow admin guideline for that system (in guides there is written how to install, where, how to integrate app with system and so on). As you are using Ubuntu you can follow Ubuntu/Debian guide. It may be time-consuming at first, but if you deploy it often (often upgrades) or on several machines it will helps you.

adduser command has switches to set up what are you asking for. Use adduser --help. Basically you can write adduser --system --home /var/lib/my_app --shell /bin/false --disable-login --disable-password. Note that most of system services has home directories in /var/lib/ or if you not provide a package for a system it probably should be as you wrote in /opt/<service>

share|improve this answer
    
I'm aware of the switches and how to use them. I'm asking what the best practices for the values are. –  strugee Jun 22 '13 at 10:46
    
There is no general rule. You adapt it to the system. According to Ubuntu or Debian I wrote what I would do: home=/var/lib/<service> and shell=/bin/false. You have to look at the manual for details. –  spinus Jun 22 '13 at 11:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.