Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a service level account to run my webserver, and this user is setup with /sbin/nologin.

Normally when you add a user to a group you must logout and login to use the new group permissions.

I'd like to add this user to another group to extend some of its permissions but since my webserver user never logs in, when or how will the user gain access to the new group permissions?

share|improve this question
    
Which operating system? If Linux - which distribution? What webserver? Apache httpd? –  Nils Jun 23 '12 at 20:21
    
@Nils - Running CentOS 6 and nginx for the webserver –  ProfessionalAmateur Jun 24 '12 at 18:02
add comment

3 Answers

I suggest su - ; /etc/init.d/NAME stop; /etc/init.d/NAME start;

"/etc/init.d/NAME restart" might be not enough.

share|improve this answer
add comment

The process's groups are set by the program that changes from root to the target user before executing the process's program. When a user logs in, the program that changes the user is the login program (login, su, sshd, …) and the process's program is the user's shell. For a daemon run under system user, the program that changes the user can be su or some other tool such as Debian's start-stop-daemon. For example, start-stop-daemon always adds the supplemental groups to the process. The user-changing program must have logic to set both the primary group from the user database and the supplemental group from the group database.

share|improve this answer
add comment

With CentOS 6 nscd might be running. If you did not change the group ownership by a hig-level-command (like usermod) you have to make sure to run grpconv so /etc/gshadow gets updated as well. If nscd is running add nscd -i group to invalidate the local group cache. If you changed the primary GID run nscd -i passwd.

Check the result with id -a $ACCOUNT.

After that - restart your service.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.