Cannot run command as www-data using su

Question

# su -l www-data ./http-app.py
This account is currently not available.
# su -l www-data -c ./http-app.py
This account is currently not available.
# su -c ./http-app.py www-data 
This account is currently not available.
# su -lc ./http-app.py www-data 
This account is currently not available.
# getent passwd www-data 
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
# getent shadow www-data 
www-data:*:16842:0:99999:7:::
# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 8.6 (jessie)
Release:        8.6
Codename:       jessie

What's wrong with my su or www-data? It used to work...

Presumably this is because of the /usr/sbin/nologin, but how then I drop root for this one script, without compromising other services on the system (nologin has been chosen by Debian team for a good reason, I want to believe)?

Answer 1

You are using su which is used to "switch user". Of course it won't work because www-data is a user account which cannot be used to login. You have told it: /usr/sbin/nologin.

Maybe what you want is sudo which is used to "execute a command as another user".

sudo -u www-data ./http-app.py

Answer 2

Without debating su vs. sudo you can try adding -s /bin/sh to your command line. (I could not verify this option is available for jessie since the Debian manpages webserver isn't working: https://manpages.debian.org/)

Answer 3

If you want not only execute one command, but switch to www-data in order to test some stuff for that user, this worked for me:

sudo -u www-data sh

It's a little bit shorter. Exit the session with [ctrl]+[d] or exit

Answer 4

With this kind of problem I have used the option -p :

su -pc ./http-app.py www-data

-p : the environment is preserved. In peculiar it does not try to login with the new account, so you dont get the message: This account is currently not available. .

Answer 5

There is another possibility (works for me with Debian 10):

As root you can edit /etc/passwd. Change the shell for www-data from /usr/sbin/nologin to /bin/bash or whatever you prefer:

www-data:x:33:33:www-data:/var/www:/bin/bash

Don't forget to give www-data a password with

passwd www-data

After that you can login with www-data as a normal user.