3

I've manually installed a service called Gate One into /opt. I want to harden its security, so I thought I'd create a system account for it to use, because of least necessary privileges, and all that.

However, when I ran adduser --system gateone, it created a home directory, which I didn't really want. Therefore, I ran adduser --system --home-dir /opt/gateone gateone, because I'd seen some system accounts setting home directories pertaining to them. However, this made the login shell /bin/sh instead of /bin/false, which it had done the first time (when I didn't specify a home directory). I'm a bit confused now on what I should set these fields as.

tl;dr: when creating a system account on a *NIX operating system, what are the best practices for setting the home directory, the login shell, and anything else that's relevant? Why?

Note: I'm using Ubuntu 13.04 Raring, if it matters, since IIRC adduser can vary quite a bit distribution-to-distribution.

Improve this question
2
  • 7
    1) Don't use frontends to useradd if you don't want them making decisions for you. 2) Explicitly set any account details that you don't want defaults being assumed for.
    – Andrew B
    Jun 22, 2013 at 15:14
  • I have the thing running as "nobody" with group "nogroup".
    – offby1
    Jul 10, 2013 at 17:50

2 Answers 2

Reset to default
10

There isn't really a specific best practice, except that the shell should be /bin/false unless a shell is needed, the password hash should be ! unless the user is expected to log in, a descriptive name should be given, and a home directory should be set to /dev/null or similar if the application doesn't require a valid home directory. The user should have its own group, preferably in the system ID range; if it doesn't require a primary GID of root, for instance, don't give it one, and certainly don't give it users without a specific requirement. It all depends. Specify everything you care about (see man adduser for all the available options).

Improve this answer
2
  • 3
    That covers most of my hit list. As a general rule it should also have a dedicated group (e.g. if the user is bind there should be a group bind with a matching ID), and the UID/GID should be within your OS's "system UID range" (typically < 1000).
    – voretaq7
    Jun 23, 2013 at 3:38
  • Good catch. I'll edit.
    – Falcon Momot
    Jun 23, 2013 at 3:41
0

If you try to install application the best choice is to make a package for that system and follow admin guideline for that system (in guides there is written how to install, where, how to integrate app with system and so on). As you are using Ubuntu you can follow Ubuntu/Debian guide. It may be time-consuming at first, but if you deploy it often (often upgrades) or on several machines it will helps you.

adduser command has switches to set up what are you asking for. Use adduser --help. Basically you can write adduser --system --home /var/lib/my_app --shell /bin/false --disable-login --disable-password. Note that most of system services has home directories in /var/lib/ or if you not provide a package for a system it probably should be as you wrote in /opt/<service>

Improve this answer
2
  • I'm aware of the switches and how to use them. I'm asking what the best practices for the values are.
    – strugee
    Jun 22, 2013 at 10:46
  • There is no general rule. You adapt it to the system. According to Ubuntu or Debian I wrote what I would do: home=/var/lib/<service> and shell=/bin/false. You have to look at the manual for details.
    – spinus
    Jun 22, 2013 at 11:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .