I have installed ircd-hybrid on my new CentOS 7 box, and I can run it fine via my normal user, but I want to run it as its own user with reduced permissions (ie, no write access outside /etc/ircd). After hours of trial and error and google, I've found these methods:
su - <user> -c <command>
This fails because I want to run as a user that doesn't have a shell or password, such as "nobody", and this asks for a password (thus always failing).
daemon --user=<user> <command>
This fails because "daemon" is a function in
/etc/init.d/functions, not a command, so it's not found when running via sudo (which is required to run the script at all) or a boot script.
runuser -u <user> <command> sudo -u <user> <command>
These are close, and so far as I can tell work the same way. If I run with no options, it works:
sudo -u nobody '/etc/ircd/ircd'
But because it has no config file, ircd just exits immediately, or at least I assume that's what happens.
ps -aux | grep irc returns only the grep process, even when run as my normal user.
sudo -u nobody '/etc/ircd/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log'
This, however, with either 1 or both arguments, returns:
sudo: /etc/ircd/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log: command not found
If I run the same command, minus
sudo -u nobody, it works exactly as expected.
What did I miss? Why in the bloody hells is it so hard to start a daemon as another user?
Update: Thanks to Arthur2e5's comment, this works as a direct command to start the daemon as "nobody" (omit quotes):
sudo -u nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log
However, my original goal was to run this as a startup script, and sudo is not an option there (
Jun 13 07:03:00 coldcandor.com sudo: sudo: sorry, you must have a tty to run sudo). runuser seems to be the only way to go in that case, but if I try that the same way, I get:
$ runuser -u nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log runuser: invalid option -- 'o' Usage: runuser [options] -u <USER> COMMAND runuser [options] [-] [USER [arg]...]
Trying the alternate syntax isn't helping (When run from root account, since runuser requires root to run):
$ runuser - nobody /etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log runuser: invalid option -- 'o' $ runuser - nobody '/etc/ircd/bin/ircd -configfile /etc/ircd/ircd.conf -logfile /var/log/ircd/ircd.log' This account is currently not available.
What's the last bit of magic?