3 added 1 character in body
source | link

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out how best to do it.

FYI, all of the following is currently being done in python, but I don't have to use python.

I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,

suksu kerbuser -c "/bin/bash authed-process.py"

This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.

So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.

The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?

This is my first post, so if you think this is better suited elsewhere, let me know.

Cheers,

Morgan

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out how best to do it.

FYI, all of the following is currently being done in python, but I don't have to use python.

I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,

su -c "/bin/bash authed-process.py"

This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.

So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.

The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?

This is my first post, so if you think this is better suited elsewhere, let me know.

Cheers,

Morgan

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out how best to do it.

FYI, all of the following is currently being done in python, but I don't have to use python.

I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,

ksu kerbuser -c "/bin/bash authed-process.py"

This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.

So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.

The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?

This is my first post, so if you think this is better suited elsewhere, let me know.

Cheers,

Morgan

2 deleted 12 characters in body; edited title
source | link

Is it possible to have a daemon run a process as another user WITHOUT havehaving a superuser daemon?

So I'm working on a project at the moment where I have a daemon that will needneeds to run a process as another user. I would like the daemon to not run as root if it's possible. However, i'm struggling to figure out how best to do it.

FYI, all of the following is currently being done in python, but I don't have to use python.

I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,

su -c "/bin/bash authed-process.py"

This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.

So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.

The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?

This is my first post, so if you think this is better suited elsewhere, let me know.

Cheers,

Morgan

Is it possible to have a daemon run a process as another user WITHOUT have a superuser daemon?

So I'm working on a project at the moment where I have a daemon that will need to run a process as another user. I would like the daemon to not run as root if it's possible. However, i'm struggling to figure out how best to do it.

FYI, all of the following is currently being done in python, but I don't have to use python.

I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,

su -c "/bin/bash authed-process.py"

This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.

So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.

The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?

This is my first post, so if you think this is better suited elsewhere, let me know.

Cheers,

Morgan

Is it possible to have a daemon run a process as another user WITHOUT having a superuser daemon?

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out how best to do it.

FYI, all of the following is currently being done in python, but I don't have to use python.

I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,

su -c "/bin/bash authed-process.py"

This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.

So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.

The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?

This is my first post, so if you think this is better suited elsewhere, let me know.

Cheers,

Morgan

1
source | link

Is it possible to have a daemon run a process as another user WITHOUT have a superuser daemon?

So I'm working on a project at the moment where I have a daemon that will need to run a process as another user. I would like the daemon to not run as root if it's possible. However, i'm struggling to figure out how best to do it.

FYI, all of the following is currently being done in python, but I don't have to use python.

I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,

su -c "/bin/bash authed-process.py"

This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.

So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.

The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?

This is my first post, so if you think this is better suited elsewhere, let me know.

Cheers,

Morgan