Sample Header Ad - 728x90

Run ircd-hybrid server as non-root user

0 votes
1 answer
961 views
I have installed ircd-hybrid on my new CentOS 7 box, and I can run it fine via my normal user, but I want to run it as its own user with reduced permissions (ie, no write access outside /etc/ircd). After hours of trial and error and google, I've found these methods: su - -c This fails because I want to run as a user that doesn't have a shell or password, such as "nobody", and this asks for a password (thus always failing). daemon --user= This fails because "daemon" is a function in /etc/init.d/functions, not a command, so it's not found when running via sudo (which is required to run the script at all) or a boot script. runuser -u sudo -u These are close, and so far as I can tell work the same way. If I run with no options, it works: sudo -u nobody '/etc/ircd/ircd' But because it has no config file, ircd just exits immediately, or at least I assume that's what happens. ps -aux | grep irc returns only the grep process, even when run as my normal user. sudo -u nobody '/etc/ircd/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log' This, however, with either 1 or both arguments, returns: sudo: /etc/ircd/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log: command not found If I run the same command, minus sudo -u nobody, it works exactly as expected. What did I miss? Why in the bloody hells is it so hard to start a daemon as another user? **Update**: Thanks to Arthur2e5's comment, this works as a direct command to start the daemon as "nobody" (omit quotes): sudo -u nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log However, my original goal was to run this as a startup script, and sudo is not an option there (Jun 13 07:03:00 coldcandor.com sudo: sudo: sorry, you must have a tty to run sudo). runuser seems to be the only way to go in that case, but if I try that the same way, I get: $ runuser -u nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log runuser: invalid option -- 'o' Usage: runuser [options] -u COMMAND runuser [options] [-] [USER [arg]...] Trying the alternate syntax isn't helping (When run from root account, since runuser requires root to run): $ runuser - nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log runuser: invalid option -- 'o' $ runuser - nobody '/etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log' This account is currently not available. What's the last bit of magic?
Asked by Eric Shields (1 rep)
Jun 12, 2015, 11:46 PM
Last activity: Jun 13, 2015, 11:49 AM