Remove ex-admin user account and grant privileges / permissions / ownership to another

Question

I would like to find the simplest way to remove the old system admin's user and group from a Gentoo server and put them all under my name instead. He no longer works here and it would appear that a large number of applications (apache, tomcat, django, etc) are currently running with his user and group, so I do not want to risk interrupting any of them until I have time to go through each one and tinker.

Ideally, all files with his user and/or group would be reassigned to my existing user. If you have any ideas about how to accomplish this, then you do not need to read on, I'm simply brainstorming alternate solutions since I have been unsuccessful at merging the two accounts so far.

Less ideally, I could rename his user and group to be something like "admin" or a new account for myself, change the password, and put the new user "admin" in all of the secondary groups that the old user was in.

usermod -l oldname admin
usermod -g oldname admin

Etc.

I have a feeling that since the user and group uid would stay the same with a name change that I would not need to change ownership / groups on all of the files that he owns? If I did, then this is the command I've thought up (I haven't tested it yet, I don't think it would work as it is but I would get it working eventually):

sudo find / -user oldName -exec sudo chown admin:admin \;

What would you recommend that I do? I think my problem is slightly uncommon because I can't just remove the old user and his home directory since I have to try to untangle the web of hundreds of thousands of files running with his permissions, and I have been unable to find an answer through googling. Any advice you can give me would be appreciated!

Answer 1

Running system services under the same account as a personal account is very bad practice. Use this as an opportunity to end this practice.

System services should run with minimal privileges, to limit the impact of a security hole. Having access to an administrator's configuration files (to plant privilege escalation methods), or worse, to an administrator's password store, is a golden path to exploitation.

In addition, configuration such as locale settings, environment variables, limits, etc. for a personal account may not be appropriate for daemons.

There are only two excuses to run daemons under a personal account. One is if you do not have root access, so you have no choice; this is becoming rare in the days of cheap virtualization and cheap hosting. The other excuse, presumably the applicable factor here, is incompetence. If the previous administrator had so little understanding of his job that things like calling sudo and su appropriately was beyond him, there are probably many other things wrong with that system.

Start by treating this ex-admin's personal account as a system account, which runs all the services. Then, if you run multiple services, think about splitting them. But depending on how messy and insecure the system otherwise is, you may prefer to install a new system from scratch once you understand what services need to be provided.