2

I would like to find the simplest way to remove the old system admin's user and group from a Gentoo server and put them all under my name instead. He no longer works here and it would appear that a large number of applications (apache, tomcat, django, etc) are currently running with his user and group, so I do not want to risk interrupting any of them until I have time to go through each one and tinker.

Ideally, all files with his user and/or group would be reassigned to my existing user. If you have any ideas about how to accomplish this, then you do not need to read on, I'm simply brainstorming alternate solutions since I have been unsuccessful at merging the two accounts so far.

Less ideally, I could rename his user and group to be something like "admin" or a new account for myself, change the password, and put the new user "admin" in all of the secondary groups that the old user was in.

usermod -l oldname admin
usermod -g oldname admin

Etc.

I have a feeling that since the user and group uid would stay the same with a name change that I would not need to change ownership / groups on all of the files that he owns? If I did, then this is the command I've thought up (I haven't tested it yet, I don't think it would work as it is but I would get it working eventually):

sudo find / -user oldName -exec sudo chown admin:admin \;

What would you recommend that I do? I think my problem is slightly uncommon because I can't just remove the old user and his home directory since I have to try to untangle the web of hundreds of thousands of files running with his permissions, and I have been unable to find an answer through googling. Any advice you can give me would be appreciated!

  • why not just change his login shell to /bin/false and limiting his potential SSH keys? It prevents him from logging in. You said you'll eventually go through them one by one so it'll change later on. – SailorCire Oct 30 '14 at 18:55
  • Back up the /etc directory, emerge -ca package owned by oldadmin, chown -R newadmin:newadmin /backup/etc/packagename.conf, emerge -av packagename Your oldadmin did you a diservice, as each package that runs a service, should install it's own user and group, and the only way to ensure those groups are created or existing by reinstalling, and reinstalling will give the service the proper user. – eyoung100 Oct 30 '14 at 19:12
  • He no longer has the ability to ssh in, so that is taken care of, but good suggestion. I was just hoping to clean up his account quickly for now, perhaps I will have to sift through everything to get rid of his user, though. Thanks! – jdussault Oct 30 '14 at 19:15
  • Changing the login name is probably not as harmless as you think. Some service scripts (virtually all the ones I have looked at) will refer to their designated user by name rather than UID. This of course makes sense from a portability and standardization point of view, but it means that if you make the old login name non-existent, you will be tripping up any such scripts. – Joseph R. Oct 30 '14 at 22:30
0

Running system services under the same account as a personal account is very bad practice. Use this as an opportunity to end this practice.

System services should run with minimal privileges, to limit the impact of a security hole. Having access to an administrator's configuration files (to plant privilege escalation methods), or worse, to an administrator's password store, is a golden path to exploitation.

In addition, configuration such as locale settings, environment variables, limits, etc. for a personal account may not be appropriate for daemons.

There are only two excuses to run daemons under a personal account. One is if you do not have root access, so you have no choice; this is becoming rare in the days of cheap virtualization and cheap hosting. The other excuse, presumably the applicable factor here, is incompetence. If the previous administrator had so little understanding of his job that things like calling sudo and su appropriately was beyond him, there are probably many other things wrong with that system.

Start by treating this ex-admin's personal account as a system account, which runs all the services. Then, if you run multiple services, think about splitting them. But depending on how messy and insecure the system otherwise is, you may prefer to install a new system from scratch once you understand what services need to be provided.

  • It sounds like in a few months I will get to wipe everything and start over, but at least for now I will follow your advice and that of the comments above! Many thanks! – jdussault Oct 31 '14 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.