I want to run two instances of dnscrypt client proxies, but I'm having trouble making them automatically start at boot. Here is what I tried:

In rc.local, this is the first:

/usr/local/sbin/dnscrypt-proxy -a -u _dnscrypt-proxy -d -l /dev/null -R dnscrypt.eu-dk

and the second:

/usr/local/sbin/dnscrypt-proxy2 -a -u _dnscrypt-proxy2 -d -l /dev/null -R dnscrypt.org-fr

I cd to /usr/local/sbin and did a cp dnscrypt-proxy dnscrypt-proxy2 and then when I rebooted I would get [ERROR] Unknown User : [dnscrypt-proxy2].

Then I searched and saw this question then I manually edited /etc/passwd and added a new user carefully copying the default _dnscrypt-proxy user and changed the id, as now it has these 2 entries:

_dnscrypt-proxy:*688:688:dnscrypt-proxy user:/var/empty:/sbin/nologin 
_dnscrypt-proxy2:*689:689:dnscrypt-proxy2 user:/var/empty:/sbin/nologin`

And when I reboot, the Unknown User error still persists. A quick ls on the folder shows me I do have duplicated the folder. Ps aux shows me the daemon has not started. A Google search didn't help me so I turned to the Linux experts here. My OS is OpenBSD 5.7.


First, here's the specific answer to your question of why the unknown user error persists: The error was in how you created the user. There are more files that need to be fixed than just /etc/passwd.

The easiest way to properly create the user would be to simply remove that line from /etc/passwd and then run adduser -noconfig -shell -/sbin/nologin instead. (And when you edit /etc/passwd, use vipw instead of just vi /etc/passwd - see the man page for the explanation!)

Second, you really don't need to create a second user. You can run the same program twice without having a copy of the program or a second user to run it under. What you need to do to run a second daemon with the same user and binary, but with different settings is simple:

  • Copy the init script for the daemon to one with another name. (You've already done this.)
  • Edit the new init script. Keep the same path to the binary and the same username. Change only the options that you want to be changed!

Voilà - you're ready to run!

  • Thanks so much!! It worked...but now i have 2 instances with same name on ps aux and i can't know which is on port 40 or 41 and think this will be a problem when i run more daemons of same program like OpenVPN or want to troubleshoot something? Also I've edited with vi am I screwed? Thanks again, i'm just a guy who decided to run a server and just downloaded Linux without previous experience and started messing lol.
    – Freedo
    Jul 16 '15 at 7:53
  • 1
    @Freedom You can run vipw and just double check that your password files are now in sync (when you save, it will synchronise them). If the daemon parameters are not visible in the ps output, you could perhaps go back to your original route of running them as different users so you can differentiate them. Or use an rc script and track the process IDs to tell them apart.
    – mjturner
    Jul 16 '15 at 7:57
  • @Freedom To see which is which, run `ps auxw" which will use a wider output format and thus give you more information about the arguments.
    – Jenny D
    Jul 16 '15 at 8:45

A few points:

  1. You shouldn't need to duplicate the dnscrypt-proxy binary - just call it multiple times with different options
  2. When you created the _dnscrypt-proxy2 user, did you also create their primary group? I see that user has a different GID than _dnscrypt-proxy (689 instead of 688) but you didn't mention copying the group. If not, create the missing group. You can do this by editing /etc/group and adding the missing entry (I'm guessing by copying the entry for group _dnscrypt-proxy).

Point 2 should fix your problem.

  • Well i tried to "call it multiple times" with different options, but when rebooting the second call was being ignored, so i tried this workaround by myself...i tried following your point 2. and add the new group but the error message still persist
    – Freedo
    Jul 16 '15 at 7:36
  • @Freedom How did you edit the passwd file? You need to use vipw and not just edit /etc/passwd otherwise the password database files will be out of sync with the plaintext password file. If you did just edit /etc/passwd, to fix things just run vipw now and make sure the entry for dnscrypt-proxy2 is there and correct.
    – mjturner
    Jul 16 '15 at 7:46

from rcctl(8) manual page:

The recommended way to run a second copy of a given daemon for a different purpose is to create a symbolic link to its rc.d(8) control script:

# ln -s /etc/rc.d/snmpd /etc/rc.d/snmpd6
# rcctl set snmpd6 status on
# rcctl set snmpd6 flags -D addr=2001:db8::1234
# rcctl start snmpd6

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.