Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

On Debian, rsyslog runs by default as root (due to POSIX compatibility). It can drop privileges after start, but a cleaner way would be to start as a non-privileged user. Could somebody please advise, what would be a clean way to set up rsyslog to run as non-privileged user? (which user?). While googling, I found start-stop-daemon, which apparently can make daemon start as non-root. is this the way to do it, or is there a better way?

share|improve this question

2 Answers 2

Starting with 4.1.1, rsyslogd provides the ability to drop privileges by impersonating as another user and/or group after startup.

Please note that due to POSIX standards, rsyslogd always needs to start up as root if there is a listener who must bind to a network port below 1024. For example, the UDP listener usually needs to listen to 514 and as such rsyslogd needs to start up as root.

If you do not need this functionality, you can start rsyslog directly as an ordinary user. That is probably the safest way of operations. However, if a startup as root is required, you can use the $PrivDropToGroup and $PrivDropToUser config directives to specify a group and/or user that rsyslogd should drop to after initialization. Once this happend, the daemon runs without high privileges (depending, of course, on the permissions of the user account you specified).

All this is from the rsyslog wiki

You should read it.

share|improve this answer
    
This would be the cleanest way to do it. –  cinelli Mar 29 '13 at 8:36
1  
@user1968963 if you want people to give you a different answer, you have to provide enough information for people to properly assess your situation. –  Patrick Mar 29 '13 at 13:52
2  
@Patrick The question seemed pretty clear; "It can drop privileges after start, but a cleaner way would be to start as a non-privileged user. Could somebody please advise, what would be a clean way to set up rsyslog to run as non-privileged user?". This answer says it's possible, but doesn't explain how to do it –  Michael Mrozek Mar 29 '13 at 14:02
1  
@cinelli ...the rest of that sentence is "to specify a group and/or user that rsyslogd should drop to after initialization". That's for dropping privileges, the method he specifically said multiple times he doesn't want. He wants to know how to change the daemon so it starts as an ordinary user from the beginning. It doesn't matter if you think it's useless, that's what he's looking for –  Michael Mrozek Mar 29 '13 at 14:15
1  
@cinelli It feels like we're going in circles; I don't know which one of us is missing something here. The OP said that he knows it's possible to drop privileges, but would prefer that rsyslog just start as an ordinary user from the beginning. You've said like four times now that the best way is to have it start as root and drop privileges. That's not what he wants; it's literally the one thing he said in the question he does not want. Everyone understands that dropping privileges is an option, but he wants a way to start as a normal user, so any answer that involves "run as root" is wrong –  Michael Mrozek Mar 29 '13 at 15:16

On my system (Debian), rsyslog is started by /etc/init.d/rsyslog, which contains something like this:

start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_ARGS

according to start-stop-daemon manual, I can specify the "--chuid" option, which will make the process start as another user.

start-stop-daemon --start --chuid daemon --user daemon --quiet --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_ARGS

so, the only question remaining is, what would be a good practice. Which user should I use? This user will have write access to my /var/log/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.