0

Hello ubuntu Commutity,

I'Ve made my search and ended up posting a question because i did not find a specific answer on how to allow one specific user access to one specific service on Ubuntu 16.04 (command line only, no GUI). The only relevant search result i've found is 8 years old on another forum but i know things have changed since /etc/init.d.

I have 2 machines, one worker and one 'foreman' that monitor the worker. User 'foreman' connect to the worker via ssh using an private key.

On the worker, the foreman has it own set of scripts. Some of theses script needs to be started at boot time so i've created service files with the directive to run them as foreman: (working as needed and expected)

...
[Service]
...
ExecStart="/home/foreman/scritps/monitor.sh"
User=foreman
...

I've also added the user to the sudoer file with visudo so it can ONLY reboot/shutdown the machine if needed, --without a password. (working as needed and expected)

#Allow foreman to reboot
foreman ALL=NOPASSWD:/sbin/reboot
foreman ALL=NOPASSWD:/sbin/shutdown

Since the service is starter under foreman's name, should it be able to start-stop the service?

$ systemctl restart monitor
Authentication is required to restart 'monitor.service'.
Authenticating as: root
Password: 

and if i sudo the command it ask for the password (and foreman is not a sudoer)

$ sudo systemctl restart monitor
[sudo] password for foreman: 

For technical security and production reason :

  • foreman should not be a sudoer.
  • foreman should not be to run admin command except shutdown and reboot.
  • foreman should not have access to other services.
  • there is no user interacton so i cannot type in any password (or input).
  • foreman needs the ability to start, stop and restart its own services.

Thanks in advance, regars,

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.