I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out how best to do it.

FYI, all of the following is currently being done in python, but I don't have to use python.

I have a prototype for both PAM and Kerberos Auth (GSSAPI), where I can succesfully authenticate the user. Now, if I run a superuser daemon then I can call out to the OS and spawn the process using the following,

ksu kerbuser -c "/bin/bash authed-process.py"

This is safe, as far as I'm aware, since in order to spoof this, you would need either a krbtgt or the users password.

So, the other thing I considered, was storing the users password in python user getpass, and then passing that password around (this is a pretty insecure solution). I won't be doing that.

The last thing i'm thinking... If i use kerberos tickets, am I right in thinking that I can use the 'ksu' command line tool to spawn a process as that user? I'm just working on a POC but figured someone here might have a better way to do this? Is there not a standard for running an unprivileged daemon that can run processes as authenticated users?

This is my first post, so if you think this is better suited elsewhere, let me know.




In case anyone else is interested in the answer...

It seems that the way to achieve this is with a forwardable kerberos ticket. The ticket can then be forward using the gssapi and on the server-side, the ticket can be used with the with the ksu command in the question to spawn a process as said user.

ksu kerbuser -c "/bin/bash authed-process.py"

This command will look in the cache for the users kerberos ticket, and then run the process. The client-server gssapi must be privileged though, since only privileged (root) users can view the keytab file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.