On Debian, rsyslog runs by default as root (due to POSIX compatibility). It can drop privileges after start, but a cleaner way would be to start as a non-privileged user. Could somebody please advise, what would be a clean way to set up rsyslog to run as non-privileged user? (which user?). While googling, I found start-stop-daemon, which apparently can make daemon start as non-root. is this the way to do it, or is there a better way?
Starting with 4.1.1,
Please note that due to
If you do not need this functionality, you can start
All this is from the rsyslog wiki
You should read it.
On my system (Debian), rsyslog is started by /etc/init.d/rsyslog, which contains something like this:
according to start-stop-daemon manual, I can specify the "--chuid" option, which will make the process start as another user.
so, the only question remaining is, what would be a good practice. Which user should I use? This user will have write access to my /var/log/
I found this question while trying to run rsyslog as an unprivileged user to receive remote syslog data from a development-machine. Assuming others have a similar use-case here is what I found:
Tested on Ubuntu 14.04.
A number of typical rsyslog feature require root, but not all. If such capabilities are required usually rsyslog will complain inside its own logs.
Apart from that the networking modules work fine as long as they use non-priveleged ports. Additionally the logging/spooling directories must be accessible. Noteworthy is that rsyslog.conf seems to use absolute paths.
rsyslog.conf is below - I would further tweak it for per-host logging, but that's beyond the scope:
Starting the daemon only requires a pointing it at your custom config, and specifying a different pid file to keep it separate from the system rsyslog (and ensure you have write access)
Confirm its running: