Hello ubuntu Commutity,
I'Ve made my search and ended up posting a question because i did not find a specific answer on how to allow one specific user access to one specific service on Ubuntu 16.04 (command line only, no GUI). The only relevant search result i've found is 8 years old on another forum but i know things have changed since
I have 2 machines, one worker and one 'foreman' that monitor the worker. User 'foreman' connect to the worker via ssh using an private key.
On the worker, the foreman has it own set of scripts. Some of theses script needs to be started at boot time so i've created service files with the directive to run them as foreman: (working as needed and expected)
... [Service] ... ExecStart="/home/foreman/scritps/monitor.sh" User=foreman ...
I've also added the user to the sudoer file with
visudo so it can ONLY reboot/shutdown the machine if needed, --without a password. (working as needed and expected)
#Allow foreman to reboot foreman ALL=NOPASSWD:/sbin/reboot foreman ALL=NOPASSWD:/sbin/shutdown
Since the service is starter under foreman's name, should it be able to start-stop the service?
$ systemctl restart monitor Authentication is required to restart 'monitor.service'. Authenticating as: root Password:
and if i sudo the command it ask for the password (and foreman is not a sudoer)
$ sudo systemctl restart monitor [sudo] password for foreman:
For technical security and production reason :
- foreman should not be a sudoer.
- foreman should not be to run admin command except shutdown and reboot.
- foreman should not have access to other services.
- there is no user interacton so i cannot type in any password (or input).
- foreman needs the ability to start, stop and restart its own services.
Thanks in advance, regars,