Home / server / Questions / 2362
Accepted
John McAleely
Asked: 2009-05-02 05:22:40 +0800 CST

How do I create an interactive daemon login?

  • 772

I run a service on a debian/linux machine which runs at boot with a 'screen' session I can always attach to.

I would like to create a username which I can run this service as. At the moment I use a 'regular' login account. I would like the added security of a username dedicated to this sevrice (similar to the way 'nobody' or 'web' are used with apache).

Requirements:

  • No ability to login, locally or remotely (so no password to manage)
  • Ability for approved users to gain access to the screen session, and interact with the service.

I imagine the solution will have creative use of su/sudo and the details of how to create the account.

linux debian login user-management daemon

3 Answers

  1. Best Answer

    First, create the account the screen session runs as (say it's called screenimage), as well as a group of users allowed to use it (say screenusers):

    adduser --system --group screenimage
addgroup --system screenusers

    Then for each user allowed to use it, add them to the screenusers group:

    adduser USER screenusers

    Then, add approved users to /etc/sudoers: run visudo and add the line

    %screenusers ALL = (screenimage) /usr/bin/screen

    ETA: To address the other answers on this post: the --system creates accounts with no shell or password. The sudoers line means that the users are clamped to running screen, as the screenimage user only.

    • 5

  2. Creating the user is the easy part. Simply add a user with adduser script (this is debian specific but I noticed it's in your tags) then edit the resulting /etc/passwd line for that user. Change the x to a ! this makes it so that no password will ever match as valid. Change /bin/bash to /bin/falseso that if someone did log in as this user they would get no shell.

    As for the rest it really depends on what service you're trying to run or how you need to interact with it. I feel like there's probably some better way to work that out than running it in a screen session.

    • 2

  3. OK, how about (in /etc/rc.something):

    sudo -u user screen -d -m service

    and set user's shell to /bin/false.

    • 1