I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out how best to do it.
FYI, all of the following is currently being done in python, but I don't have to use python.
I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,
ksu kerbuser -c "/bin/bash authed-process.py"
This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.
So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.
The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?
This is my first post, so if you think this is better suited elsewhere, let me know.