I have installed ircd-hybrid on my new CentOS 7 box, and I can run it fine via my normal user, but I want to run it as its own user with reduced permissions (ie, no write access outside /etc/ircd). After hours of trial and error and google, I've found these methods:
su - -c
This fails because I want to run as a user that doesn't have a shell or password, such as "nobody", and this asks for a password (thus always failing).
daemon --user=
This fails because "daemon" is a function in
/etc/init.d/functions
, not a command, so it's not found when running via sudo (which is required to run the script at all) or a boot script.
runuser -u
sudo -u
These are close, and so far as I can tell work the same way. If I run with no options, it works:
sudo -u nobody '/etc/ircd/ircd'
But because it has no config file, ircd just exits immediately, or at least I assume that's what happens. ps -aux | grep irc
returns only the grep process, even when run as my normal user.
sudo -u nobody '/etc/ircd/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log'
This, however, with either 1 or both arguments, returns:
sudo: /etc/ircd/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log: command not found
If I run the same command, minus sudo -u nobody
, it works exactly as expected.
What did I miss? Why in the bloody hells is it so hard to start a daemon as another user?
**Update**: Thanks to Arthur2e5's comment, this works as a direct command to start the daemon as "nobody" (omit quotes):
sudo -u nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log
However, my original goal was to run this as a startup script, and sudo is not an option there (Jun 13 07:03:00 coldcandor.com sudo: sudo: sorry, you must have a tty to run sudo
). runuser seems to be the only way to go in that case, but if I try that the same way, I get:
$ runuser -u nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log
runuser: invalid option -- 'o'
Usage:
runuser [options] -u COMMAND
runuser [options] [-] [USER [arg]...]
Trying the alternate syntax isn't helping (When run from root account, since runuser requires root to run):
$ runuser - nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log
runuser: invalid option -- 'o'
$ runuser - nobody '/etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log'
This account is currently not available.
What's the last bit of magic?
Asked by Eric Shields
(1 rep)
Jun 12, 2015, 11:46 PM
Last activity: Jun 13, 2015, 11:49 AM
Last activity: Jun 13, 2015, 11:49 AM